Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd.exe
  • Size 69KB
  • SHA256 00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd
  • MD5 28f71f85417e8897ea1f27d8d9c16248
  • SHA1 c3f0881b1e543ac8a9172e0528ac1400820622dd
  • SHA512 7bebacbcfd25325cc9af2be0727e926f57564c437e0a03c63e188bee900c1d3370206e62cdb86d7634f79d8b2678235d36796c000c4e879a70f173b68f4ce988
  • SSDEEP 1536:OtBd0whwlxq3REfnynG2JrkDUgjsqyzMIN8jcahCc4ySyI:O2wJevwuyzF3ZyXI
  • TLSH
    T1F963C274C389C019EAD7BA3552C9FE7B4745B922E787175B0824B2983E3B6F2CC81352
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionmagniberprivilege_escalationransomware

  • Detect magniber ransomware

  • Family: Magniber Ransomware

    Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

    ransomwaremagniber

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe
  • Size 1.5MB
  • SHA256 0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224
  • MD5 07563c3b4988c221314fdab4b0500d2f
  • SHA1 a5f53c9b0f7956790248607e4122db18ba2b8bd9
  • SHA512 e0264bf772ba43377d1dcdc95dccdacc16ccafee28e8d91a9d532cf2383b0d1ad43625cd0b09555018583db796a59603ad12d568e2aea154594b5d02248d0ecb
  • SSDEEP 12288:+OFevZPYI+MbO7NkfWcIV8wZ9CeqFrOdS2KCwILo2bx9I5Nweb/yCdwO4Pzjzbf4:jFaoccQ7XUCdw1X32ekwVXeU+
  • TLSH
    T1FF6572DCBA4CABA496ED5730C3F3655862E6C9F21014C22FC748E4D18E9690B8FDD9D2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    125f75320c80d5b4d73c000058f26e92207d28a3d7d88551041f7a62f2a59e3c.exe
  • Size 214KB
  • SHA256 125f75320c80d5b4d73c000058f26e92207d28a3d7d88551041f7a62f2a59e3c
  • MD5 85fab8174bc91d7c0538fb67336e852c
  • SHA1 0c7fcf278d72608caf7443e8830f2365c67f9916
  • SHA512 9e077abb0228d9b057ba0bfe83f3a2a9fdb1ea31df6aebee5fdda7e527ba5ed5b4cbea5e6f15f4816e136b1d775e84f2aae0d85455886c686d23536cbb98b697
  • SSDEEP 3072:0iEm4ok3S63xBNPNO4CgasIBbCFO5JpOALujzkhQeMuYSrC4BA3vHCxX:JEm4oiS6HzO4Cgip5JAmwkhFpYUC4I8
  • TLSH
    T17324E11272D0D972D0B24A724C68E594763DF7914BB8178B671E2ABB1FB03D08EB6347
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygandcrabransomware

  • Family: Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • GandCrab payload

  behavioral5behavioral6
• • Target
    133e003cc510e3d2d0c7df70a603448605641256c88ce64a3bcabb762295d622.elf
  • Size 1.8MB
  • SHA256 133e003cc510e3d2d0c7df70a603448605641256c88ce64a3bcabb762295d622
  • MD5 89f48e5e7a5532eb34c4d22dba7c16bc
  • SHA1 58964b055faf9b7f72d1725786f8112f56c187bd
  • SHA512 f3e982d8b534ad0f9a921166d8842683f7bd5d2f7307d572f16dcce0c00129709249c2de2fecd20e538c194085c2db5fdde1ab82818eb2373f2af124f2f9077c
  • SSDEEP 49152:cqew+96PoBjYs5ngToDEZwTFgN+1TtI1:cqezRob
  • TLSH
    T175954B47F5A250BDD5BAC934832E6137F6317C0D41212A6B67D4EA203F59F209F1EBA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7
• • Target
    134de049f7ef48728b0a126b5f440494817d577c3fbdb92792afa15ae08f1393.msi
  • Size 1.1MB
  • SHA256 134de049f7ef48728b0a126b5f440494817d577c3fbdb92792afa15ae08f1393
  • MD5 0275f9bed85537e199da466e885b5548
  • SHA1 67a0cdb1ebd5682cff0582a516ffd611a827296e
  • SHA512 e586c3339ddfdc95609b81002262cd1ba64a99a09832698b39330e4241d29301f46bd33080b6415162f4385ca7dfc509d69c429265455223574cffc2baf25a90
  • SSDEEP 1536:8hMhkJn+cDx79Z3vH4OGpzZZL0Ds0DI7H:S/xD99vGpzZZ1
  • TLSH
    T10045197F7FC89030EA3536379951D67A4BE0AC084252C6AA1C8DB34D5932CBD397A32D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionmagniberimpactpersistenceprivilege_escalationransomware

  • Detect magniber ransomware

  • Family: Magniber Ransomware

    Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

    ransomwaremagniber

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (92) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Uses Regsvr32 to proxy-execute a script

    Regsvr32 is a signed Windows utility used to register OLE controls. It can load scrobj.dll to execute malicious scripts from local or remote locations.

    defense_evasion

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral8behavioral9
• • Target
    148c2d55d317029444578d478aeedcc834cffa4db695702adc8add568b517557.exe
  • Size 23KB
  • SHA256 148c2d55d317029444578d478aeedcc834cffa4db695702adc8add568b517557
  • MD5 f739d9e0a8ba8b82f65ef09f6d7d4dc6
  • SHA1 ab94d1c1ec147ea6bfd159cc740a9f7fce54e840
  • SHA512 c98a68f8232c73e8be9e001f4a7049f29d5f884ee429aea81f36f0534ced913f0dcae54e09a9b1272b69955c9121b831378255ec872f59ec6d698ec94899eead
  • SSDEEP 384:z3Mg/bqo2LgyOg/Uzv3pzDKF+98cJAr91CkkzLb5Me1:Fqo2514pzDKN0Ar9RqLb2e1
  • TLSH
    T15FB2D51867FA4A38FAFF2E782DB250515775BD57EC3DD74D188A004D0822B9C8D60B67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionchaosimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Chaos Ransomware

  • Family: Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral10behavioral11
• • Target
    151e21dde7bb3ce31c04e25638e7513f83e19cbd0a7549a574d97339c9486f80.msi
  • Size 1.1MB
  • SHA256 151e21dde7bb3ce31c04e25638e7513f83e19cbd0a7549a574d97339c9486f80
  • MD5 dcdef9b1dc316aa6dbbf575e67b58be2
  • SHA1 23e0701cdcba071ac74e6caac125a4c987020083
  • SHA512 56097d60da3c9d284957450658d68ee3e3e50026f71aa62e829de8236ad888f19913360fe45af5593a0f9cd71716d254b32f4547500f29ae8346ea0a21a8b8af
  • SSDEEP 768:qVqfv+7ARGxnyXU/xsTIi2vXMUAoQktnv1jS03SQOSyWMDCjyWMDCTYiyx:J3+ZXOTIi2vX+ofnl/f0Ds0DW7yx
  • TLSH
    T1CA35B3022F4E0229D263197AAB2D272777395D021F8134D3512DB5DC09BB4B39F67BA7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionmagniberimpactpersistenceprivilege_escalationransomware

  • Detect magniber ransomware

  • Family: Magniber Ransomware

    Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

    ransomwaremagniber

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (73) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Uses Regsvr32 to proxy-execute a script

    Regsvr32 is a signed Windows utility used to register OLE controls. It can load scrobj.dll to execute malicious scripts from local or remote locations.

    defense_evasion

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral12behavioral13
• • Target
    158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
  • Size 63KB
  • SHA256 158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7
  • MD5 5ac0232ae6cd6380c135ebcb607de9e3
  • SHA1 44e7ee71128c2f1948490016d50175ffb45acb35
  • SHA512 9b7002830d70c74176afe292673fff18856843c79ea1eb5278f19a16301c8e2e542f6b772730a7db0a0405910c351baeb85fc157fc737fba48f96bebcc7aaa5b
  • SSDEEP 768:cMm3L4o3g/vXNbINb0ZX+pKIzLDwUzc80gmq3oP/oDI:cMm0Ec/NRur/0O8/oM
  • TLSH
    T1005396295173C92DC42C82B815EB2FBC27B0AF166450C76E4A79E6AC3F273B78D10756
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  discoverypersistenceransomwarespywarestealer

  • Renames multiple (90) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Sets desktop wallpaper using registry

    ransomware
  behavioral14behavioral15
• • Target
    160dd5158fa00a537fee81df13e8bc4eb14a464806aa3bb3e252a7c435dfcff6.exe
  • Size 265KB
  • SHA256 160dd5158fa00a537fee81df13e8bc4eb14a464806aa3bb3e252a7c435dfcff6
  • MD5 e966f2760b0d0f5ae5860a5790be4a35
  • SHA1 16d0cbf30be1b864615b6d523402b2a59d3f3d44
  • SHA512 0de342e22915803fa0a8c8dfa93755d9e92a699d00ead83d316cdbcc846f777d1fbb16df6cea0ee048d003f8b800b19a153e2d40d8ed94a45bb28ca4113f4e65
  • SSDEEP 6144:WNXQxVs9xAQ+Vuy4elu8GiXzMlTB5xAuFQfadQHHkC+:WVQxVs9xEu6LzUTfx9QfCekH
  • TLSH
    T1EA44AF1AB3A00DF5DC67827ACD838B55EA727C054730D34B165A93A75F33361AA3E34A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryazovpersistenceprivilege_escalationransomwarespywarestealerwiper

  • Family: Azov

    A wiper seeking only damage, first seen in 2022.

    ransomwarewiperazov

  • Renames multiple (13788) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral16behavioral17
• • Target
    166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3.exe
  • Size 61KB
  • SHA256 166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3
  • MD5 e06246e30ae66a2dd4de85270947dbb7
  • SHA1 02e99b245f2734020334f80504710db43a141fea
  • SHA512 03b426b28eb2f3f6c800d70ae19fbd0e897d4f1c4537659a2eb9f31ffc5789062b3576f18059f3f2e51f064edce1865c39572aacdd133b9486b71837efab8790
  • SSDEEP 768:oKsMqCXfVcWGpuuM9ZkiANIUI2YLDwUzc80gmq3oP/oDE:oKseG1M9ZkiAPQr/0O8/oQ
  • TLSH
    T1D753542852738A2DC47C82B815FB2F7C27B0AF565460C75D4A78D2AC3F277B68D10B56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverynitropersistenceransomwarespywarestealer

  • Family: Nitro

    A ransomware that demands Discord nitro gift codes to decrypt files.

    ransomwarenitro

  • Renames multiple (89) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Sets desktop wallpaper using registry

    ransomware
  behavioral18behavioral19
• • Target
    188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe
  • Size 3.4MB
  • SHA256 188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99
  • MD5 35acbf4b0e8cfe8b9c3c2d5da5eb0131
  • SHA1 bc2d3b96b8f5d227b41611f64216753a898e804c
  • SHA512 381f3a0867207e9824a1382620c17d1b445e307512982279a285e7cb4ce2f79a7f48b549d5c78e0f1ef707ff10ec249784a1d6e88788eba1e861f492f19fe2ca
  • SSDEEP 98304:NUqA6Sp+ZIogCxfwijqisUzS5Q1J6KtqxxwwpJKILMW:JAOC/MINxxVpEp
  • TLSH
    T122F533638D241271EBBAA23F9A5DD101A3607E1541D5B893F15EF4E06E73EF20FA2C94
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionlegionlockerransomwarethemidatrojan

  • Detected LegionLocker ransomware

    Sample contains strings associated with the LegionLocker family.

    ransomware

  • Family: LegionLocker

    Ransomware family active in 2021.

    ransomwarelegionlocker

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Renames multiple (103) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral20behavioral21
• • Target
    195cdde8bc2a98f3583f9647171a5b47d9f577f4ffd5805bb3367b012f3428d3.exe
  • Size 143KB
  • SHA256 195cdde8bc2a98f3583f9647171a5b47d9f577f4ffd5805bb3367b012f3428d3
  • MD5 a82e420c74def2792316dfe5e330ff28
  • SHA1 6bb9f6c014d036ad8172d275612551dc0e9e5fa3
  • SHA512 08a4a6123543ef53c7ecde1ea1783d4a36cf2810ec6add83de4f34443c895680a23c5492ed3f5b4fafce116b8794a9241279f6f0cf537b46572c42c5fe30edd3
  • SSDEEP 3072:o+HcL2ICfSTntqSQRruiMZMqqDL2/AwvdK7Vjp9:haDtORruiMyqqDL6tvdQp9
  • TLSH
    T1A8E38B1B72D190B2F0F30675E9B4AD21092F3D202F949EEB26E655ED1D210F1AD3AB53
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral22behavioral23
• • Target
    213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.exe
  • Size 235KB
  • SHA256 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259
  • MD5 07f482fdc70a699d02495c8b4dc1ee63
  • SHA1 8c536b4c8a9a810635daa506c67f70180b048c83
  • SHA512 5a8ec11ed23b6e17e894965cf3fab92ae55e7408ee1f6bd00a59ba43c61648cd9d9fd7894288427a14446d3d9bc59c66b0416d57f7de9cd626d64e575ca14d91
  • SSDEEP 384:LTxamiSIM6mcfE7gdEVruKJPB5wVKnJZQB59Wrc1:LTYSv6mcfEzruKdB5w0JZQBL
  • TLSH
    T15F341904667386D6C49E05BA1EF9D6801C30A951292FBF9AF5F1BFCBB835D41A18D2CC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverychupacabraransomwarespywarestealer

  • Detects ChupaCabra ransomware

  • Family: ChupaCabra

    ChupaCabra is a Windows ransomware written in C#.

    ransomwarechupacabra

  • Renames multiple (4076) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Modifies termsrv.dll

    Commonly used to allow simultaneous RDP sessions.

  behavioral24behavioral25
• • Target
    227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c.exe
  • Size 4.7MB
  • SHA256 227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c
  • MD5 087045c4a829688c481b46bfc1097c54
  • SHA1 b76544c11fc23dd0cdabbb0211896fd88fcc50b7
  • SHA512 ad73da94d6203aa331c5e693df6c1a45d9e2b71477262e40102f0d5264283365117fed990889aa336316869d7727600ee2d7d79268a91a96c62b1d7c388d271b
  • SSDEEP 24576:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKN7ChBWMQ+uSJJd3Dkdd:ajLuSh3i+FtvkMzT+TIR
  • TLSH
    T1D9367D567BC5C16AC06F03361862C3893272F8A69F1383A73495B32E7D7A7C44DB29B5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnominatuscryptopersistenceprivilege_escalationransomwarespywarestealer

  • Detects NominatusCrypto C# variant

  • Detects NominatusCrypto DOS executable variant

  • Family: NominatusCrypto,NominatusStorm

    NominatusCrypto aka NominatusStorm is a ransomware written in C#.

    ransomwarenominatuscrypto

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral26behavioral27
• • Target
    231bba5652f6fbdbab3016362fb7925fc4e4489fff5e6a4a98c37fba5bd0cfe9.exe
  • Size 55KB
  • SHA256 231bba5652f6fbdbab3016362fb7925fc4e4489fff5e6a4a98c37fba5bd0cfe9
  • MD5 b2f083ee365141030c49ddffc325f6be
  • SHA1 f1091be7e566d068403a87b0e7ed4b959c952c8e
  • SHA512 09ce81f0bbbcc42444b177857de062ba09213a30d0d1171dd8902cab2592b1773b3a6090e017d4b68f6d9782f25f69d524f7fb84798a7e5e4f576aaa05c71430
  • SSDEEP 768:xvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1ERnqfD19l3C6J:LNeRBl5PT/rx1mzwRMSTdLpJRyvx
  • TLSH
    T11A43C007746990B2CDA14B70293A6F5F8FBA641580B488974F390D8B3FD5472DB393BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryevasionexecutionphobosimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (830) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral28behavioral29
• • Target
    244ed096d26ae952b472dfbfbd27c6eed8db08e02ba6b5239236ef4d5a977e6d.elf
  • Size 4.5MB
  • SHA256 244ed096d26ae952b472dfbfbd27c6eed8db08e02ba6b5239236ef4d5a977e6d
  • MD5 ff107185650f7780b74f584f2ce275dc
  • SHA1 5486f4183f173686fa444c218c6b2dd62149c15b
  • SHA512 dda5a9c8d5eedbeaf4842c6360e9b9a12d5d19e409fdfb8758152a735bb767ef67fb8d681663bdecadec1664509eabb43a803f51b1064f33440f460cdfaab80f
  • SSDEEP 49152:vIPweIRiyshXorLNEwVzZbW9teAJTwu7dXLcK/tCZ2kZLKYDsf8GulVkdkotl7qq:4TONEYb0TwAXYKFCNLjDoM/i
  • TLSH
    T15B265B50FECB54FAD6071A7180BFA33F673155098336DBC7DA406E53E82B6E15A32229
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral30
• • Target
    259f9ec10642442667a40bf78f03af2fc6d653443cce7062636eb750331657c4.exe
  • Size 444KB
  • SHA256 259f9ec10642442667a40bf78f03af2fc6d653443cce7062636eb750331657c4
  • MD5 2dab3c06cafa0877ed841eb72beae0ae
  • SHA1 eda84fdb6fab3592df696fe57d52045d8f664bf7
  • SHA512 d3cd2b9f660a2fb57d71ae67a84b2bd9a997234122d5e0b905eff25644d949104708278fa123ba31dfb5acc8eb5d8301dc7e44c631a752d24b27888b525e0291
  • SSDEEP 6144:+zEXUXIsN2vGdSw0ld6Avhrjpjryd6O9mrmcFS8AKDbAw:+zEXv2xSwa62hvUf9mCccSAw
  • TLSH
    T154A45C16B79559FDD06AC07482464521BA327C9A0B35FEFF1698B2352E36AF02F3CB14
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral31behavioral32