General
- Target f09d5ae1c73a1b47e027dc58db83c5dc814395dcd575cc588e7c174f3ef04265
- Size 186KB
- Sample261008-nlbjdafv7w
- SHA256 f09d5ae1c73a1b47e027dc58db83c5dc814395dcd575cc588e7c174f3ef04265
Score
10/10
Malware Config
Targets
-
- Target 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe
- Size 326KB
- SHA256 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545
Score10/10Family: PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
Renames multiple (7695) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1