General
- Target Uninstalr_Portable.exe
- Size 7.5MB
- Sample261002-xvszfswfka
- SHA256 137932cece0fdea0efdbe221325ddd57d7addac7facd3d6587a55f665135f851
- MD5 47d12212c028fff371b5be6d69b53a1c
- SHA1 de8b3bc58474db2ac93b363d13b6df9f5e4ec989
- SHA512 fdbccdd4051831e3db2d275fe063b4ecfcf8f1b4244f3cd44af4733f64ea56914788b0529c822305086fff991d83db8698c61b6d0a487496489d366998f8bb61
- SSDEEP 196608:pFpjIrcRHYMABeeVMr0T1+V2HO8BaAztlJ/300VXmKNnlX:pFpsw1Y1FMwLHrFDV2KTX
- TLSH T1CF763360965B18A7CD388B3C3243FD16C7A02FBBE6C11B14219EF94DA472FB1E974919
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Targets
-
- Target Uninstalr_Portable.exe
- Size 7.5MB
- SHA256 137932cece0fdea0efdbe221325ddd57d7addac7facd3d6587a55f665135f851
- MD5 47d12212c028fff371b5be6d69b53a1c
- SHA1 de8b3bc58474db2ac93b363d13b6df9f5e4ec989
- SHA512 fdbccdd4051831e3db2d275fe063b4ecfcf8f1b4244f3cd44af4733f64ea56914788b0529c822305086fff991d83db8698c61b6d0a487496489d366998f8bb61
- SSDEEP 196608:pFpjIrcRHYMABeeVMr0T1+V2HO8BaAztlJ/300VXmKNnlX:pFpsw1Y1FMwLHrFDV2KTX
- TLSH T1CF763360965B18A7CD388B3C3243FD16C7A02FBBE6C11B14219EF94DA472FB1E974919
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1