General
- Target f09d5ae1c73a1b47e027dc58db83c5dc814395dcd575cc588e7c174f3ef04265
- Size 186KB
- Sample261008-nlbjdafv7w
- SHA256 f09d5ae1c73a1b47e027dc58db83c5dc814395dcd575cc588e7c174f3ef04265
Score
10/10
Malware Config
Targets
-
- Target 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe
- Size 326KB
- SHA256 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545
Score10/10-
Family: PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (7695) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1