Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe
  • Size 716KB
  • SHA256 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969
  • MD5 ac625552601c190656dcb8cf4c21cd1d
  • SHA1 acad7a91c2812a0652d62f252774454c217666e9
  • SHA512 9e04dbbc624e808a678e64648dbc12deb286341876ea4590d50f996732dde2b91c6b7defbffcbdd3883c74a98488a0ad26540b364942d3117625770bc4e5e6d3
  • SSDEEP 12288:nB6xrkyoUKbidQN0M2TNK36YPiCuL1+jZ5tXdAD6x/NJxaZUzrd9gW6PdrO5SAou:nwrkyoUGJJgWQrOUAua
  • TLSH
    T100F47C2A779C01F8E177D2798C954646F7F17C0613615BCF83A04AAA2F2F6B41E7A390
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionblackbastaimpactransomware

  • Family: Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (690) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2
• • Target
    05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
  • Size 1.4MB
  • SHA256 05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f
  • MD5 0ada88218b67a313a4f5ab0062fbc4e6
  • SHA1 15dfcef932d666fdc7501bcee357ec2aabfcfdee
  • SHA512 0b217e5aa8b17d347dbb05507cb5cf179328aad593fb65a8083ca8c300de4901eb55e6c8e971ce3280f50ceefd327332cfafde0280e09044d8da1dc8e20a49ed
  • SSDEEP 24576:J6w15zVAFj5WEx9+22sHFXVYmLmYy+vz236ZSV8BGxon3sgGhzl1KsIVy:QsV85WU9+ElYmyZMz23sSyBGdgelIsj
  • TLSH
    T17F65138581910B9BDC0143339D271B86BBB108355174EB16FBE3B39D7DE9310BE46AEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionaesrtimpactpersistenceransomwaretrojan

  • Family: AESRT

    AESRT is a ransomware.

    ransomwareaesrt

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    defense_evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (131) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Modifies WinLogon

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3behavioral4
• • Target
    07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799.dll
  • Size 838KB
  • SHA256 07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799
  • MD5 afa27795c0c86b6afeb138d0fb09506b
  • SHA1 d32e44f7e04a8c84e7159ed020dcf26b6e51416e
  • SHA512 85e92d60000981d836c8fe102a191e21c94f6add14fef0dd33816060699dfa5a05e1db38bd8b7194ad9e1ff30240bfdf807f91d0abe535733e2a2fc1d7264fc0
  • SSDEEP 24576:pyAo7FAIP03acBtXWKe25ep59MxQU08wHG3MJAQof1hB:Lo7ARBtmKe28MSU08wHaM6Qo1hB
  • TLSH
    T13D05AF11B6AAE0B0D69D00F508386F1665BDFC6407B08EEB67C87E2FBE352C14636E55
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discoveryexecutionransomware
  behavioral5behavioral6
• • Target
    2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe
  • Size 2.6MB
  • SHA256 2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5
  • MD5 8df1a9b8f79a0b13a3c1591ad38042f9
  • SHA1 edab7f4055d17d2bade0ede1435c7254e09ec627
  • SHA512 bfc807d2fd2304cb9682845b745da49f5211f1b2748e8f5dda497c6776bcf287898f9a81d17509a601abd7e7dd166ab5501981c35db5acd59d05e81408aec0a2
  • SSDEEP 24576:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK+:KjLuSh3i+FtvkMzT+A
  • TLSH
    T15DC55A4977D4C126C0BF0736487392852372F8979E1346AB34E5B32E7E757C04EA2AB9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnominatuscryptopersistenceprivilege_escalationransomwarespywarestealer

  • Detects NominatusCrypto C# variant

  • Detects NominatusCrypto DOS executable variant

  • Family: NominatusCrypto,NominatusStorm

    NominatusCrypto aka NominatusStorm is a ransomware written in C#.

    ransomwarenominatuscrypto

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral7behavioral8
• • Target
    2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe
  • Size 780KB
  • SHA256 2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921
  • MD5 712e164996f8a491ca08dd3eb4b5b16a
  • SHA1 07fbb42d5168e3ce7f0aedb437e0a1cbca59ea5d
  • SHA512 5ba44f6528907c94c0fb650dbdc0bfe7923e096961f05865f7a4ffab523d2c3e7d1bed095b69ce02cad5e830b7a5f4dccfd2e7a00ff291556259dd884023f078
  • SSDEEP 12288:N8St0dbGh7Qzq95i05ymO63rcBaIiICzVcZLMAdGFRaTdlIG3pct1v1Ru9IZRtI:N8S6wNQm9hdoYVIChchnGahutXRjhI
  • TLSH
    T1BE05127742B195F5C9581374F8A10F4F36ACC3245988B298F05BE2AADC1D64E9EF83B4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryhantapersistenceprivilege_escalationransomware

  • Family: HANTA Ransomware

    Ransomware family first detected in March 2021 with multiple minor variants observed.

    ransomwarehanta

  • Disables Task Manager via registry modification

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral10behavioral9
• • Target
    2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb.exe
  • Size 435KB
  • SHA256 2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb
  • MD5 4e70adee51ccfbdacacaeeecb7a377aa
  • SHA1 fbb0a73c9e9841636be71bfea104b8aa43cb8d8b
  • SHA512 e76513003f5cec1b4d9c0752a3c95d7bae0b4cb831a7b7bb35187f5e4648a3f8f4a98953a191f980dfb52988662cb0dd731f40f3270e7aca558d011bc82a00be
  • SSDEEP 12288:/hvwwek908JYMyakTV1fZifGOUWRJ2mQ:Jw0uMyakJ1l+YmQ
  • TLSH
    T12A944A47E3A250FCC06EC17847576533FA717C4C4525BB6B6BE0BA312E21B909B2EB16
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8.exe
  • Size 131KB
  • SHA256 3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8
  • MD5 b7d1ed4093d0ef39c512cb517bce8916
  • SHA1 2fcfceb83adfa7210bb71118710630acb566c698
  • SHA512 f9a26d9b9d7e83c30a35fc78412f11aa774e881661288f8fd43e0495861d5484b765240f5e34d04ef8eb3ba23e792cdffcaac76a2eb5a377596a134b8fb3b2a5
  • SSDEEP 3072:Mc7q9xwhoUhRPkkWfZf5wX/gowJOLEnlywUaBbeWWiUNU:Mz9xwhlkkS+Xoow0mlywJ4w
  • TLSH
    T1E4D3028268BDDB1EF201453693077F79539862540FD39EEF0CFBE2246045F6AAB2B614
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsevenpersistenceransomwarespywaretrojanupx

  • Detects Seven ransomware

  • Family: Seven, SevenCrypt, 7ev3n

    Seven aka SevenCrypt or 7ev3n is a ransomware.

    ransomwareseven

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral13behavioral14
• • Target
    3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a.exe
  • Size 182KB
  • SHA256 3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a
  • MD5 5a701b573cbe8b83a904c887af60104e
  • SHA1 eb616c2de8d04ad836208a9ea347e66fecb6dcbe
  • SHA512 970f3507df7dd4ac52c5648283069f6bbc6ce5016cbec49665f62b69ce338962e3bc9256d91c1271d3ecc99ddaf89f590cf601530a7be8aa70d6d97d8b020434
  • SSDEEP 3072:tuTO4rRZiOWvXjmGh1XscjYU39Mq+ZDPUEMTlqjraE7Ehit2WpFGCOP:tkZVWvTmGhxas9gZDPFMTkGEA4sWpEJP
  • TLSH
    T18B04AE47B3F400A9E176D27AC8F687169BB1BC110B7153DF26998A9A6F33BE04D35312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryazovpersistenceprivilege_escalationransomwarespywarestealerwiper

  • Family: Azov

    A wiper seeking only damage, first seen in 2022.

    ransomwarewiperazov

  • Renames multiple (13085) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral15behavioral16
• • Target
    3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e.exe
  • Size 37KB
  • SHA256 3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e
  • MD5 5c0e12b00990af8e6a82dee0c0e09d95
  • SHA1 cf2be3ad4715d73a3d55c26f8eb972de163b255d
  • SHA512 2cc6d4a725e1b21d1c0e7108c7103b17d6150add109bf4d3ce964e00210c3d7880b660c6a57e9c5695316fb60490328acc252232b63196cf76598c76b70c2ed2
  • SSDEEP 384:BcOmK3hUidksXR21cGMy8PIU5fHkFlacPZrAF+rMRTyN/0L+EcoinblneHQM3epY:6OmK3bLGv8PIU58KcBrM+rMRa8NubGt
  • TLSH
    T1F9033A4D7FE18168D5FD067B06B2D413077AE04B6E23D91E8EE164AA37636C18B50EF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral17behavioral18
• • Target
    Antivirus_Upgrade_Cloud.1d094d24ac37f2.cpl
  • Size 271KB
  • SHA256 f7cf9b53f0124b9fbc1cac8991b51a24a03f8feceb711677aae39b916a686c55
  • MD5 1e19d57d74f09c03521d89cb75695281
  • SHA1 28b57dc71d0c36aa5cfb65343711affb930d5adc
  • SHA512 bc6fb08826f5cff9d606f42a3bd61eeb366f8b5a8545a1fb91db1ccb79d1719086e4815500753966e701b9f0503ec83ad3094125314b7bd42209f826c0840fa9
  • SSDEEP 3072:rer5jmhgECqcvk23AvWli13fu3s4CaCyhvt2l7Fl50MSy9Vb:r9Cqcvk23AvWr3s/SW7WSvb
  • TLSH
    T1F744494F2BA431D4C161C3B99B458391E1F138702B9232EF15E6FA7D8B539DE5A34B0A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionmagniberprivilege_escalationransomware

  • Detect magniber ransomware

  • Family: Magniber Ransomware

    Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

    ransomwaremagniber

  • Suspicious use of SetThreadContext

  behavioral19behavioral20
• • Target
    4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe
  • Size 5.4MB
  • SHA256 4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4
  • MD5 c74eef88110f2fe87a1af8e5745684de
  • SHA1 c9db2870dd23947c41d3678267bebcb889a45821
  • SHA512 cb58fec67e7279411991e66104d290802e0c09ef49d0eb63ca2a1bd7636cb611fe6dce53d636e907310f593239da4ec2c925882e97b9623134a6ca0836693bc4
  • SSDEEP 49152:ljLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:VLu1TIRtUOV5Zv
  • TLSH
    T10F464A05B7D88526D4BF473A593393841371FC939C23876F31A0A26E7E717908D92BBA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnominatuscryptopersistenceprivilege_escalationransomwarespywarestealer

  • Detects NominatusCrypto C# variant

  • Detects NominatusCrypto DOS executable variant

  • Family: NominatusCrypto,NominatusStorm

    NominatusCrypto aka NominatusStorm is a ransomware written in C#.

    ransomwarenominatuscrypto

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral21behavioral22
• • Target
    5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc.exe
  • Size 3.0MB
  • SHA256 5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc
  • MD5 591a72097e280ad1fd07cc5d0b81b180
  • SHA1 ac838556c813413afbb58880754baca9d11d1807
  • SHA512 2041f1c40a675199a01c7c3ae3a8ce2b6c5b38ed311a558bef70ed9100687af956459c8680ac24c34b0ef8c7bb705b7010671b5111043606a62a098f04b8e6d1
  • SSDEEP 49152:+kKSYoAZCTE3TUzwkATt0uFZmcg9Bsle+iE7YCANGCm8A5FUj7+zsqmq7c+:+k5YoAZCgDG8T9pYBsVMTcIKs
  • TLSH
    T177E5AE16FAA356EECDA71570385EB33AD7304A28001D8EA3D7D49E6CBD7E7201D8861D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryblackcatransomware

  • Family: BlackCat

    A Rust-based ransomware sold as RaaS first seen in late 2021.

    ransomwareblackcat
  behavioral23behavioral24
• • Target
    5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa.dll
  • Size 850KB
  • SHA256 5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa
  • MD5 4c54bec464ba0c2b9d522643e1b3ebe7
  • SHA1 db497b95c79e41212577db0ba06777b62db209ff
  • SHA512 ca9487b37a4163fba13442b6ffa728730cbb67f6b4dc8d6cf8ea8f3ae8099a3aab811cbcadc5e0c24511cf9670664bebd3b9da2fc98566f3a0279c50577ec763
  • SSDEEP 24576:0Y/KwH785Qjo2tkYvEEGuzTWu523YxcAf:7/785Qjo2ZGuzTWI23IcAf
  • TLSH
    T13A059E11B69AD0B0E79D04F50838BF2A65BDAC6007B08EE7A7D47D2FBE352C14636E45
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryblackbastaransomware

  • Family: Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta

  • Renames multiple (2779) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  behavioral25behavioral26
• • Target
    5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597.exe
  • Size 115KB
  • SHA256 5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597
  • MD5 5ed0c11008735405eb7da211006c0ce4
  • SHA1 60f9d5879c5fbb25f3a646de35476ad10e065963
  • SHA512 9094b7ec634fbb7cd659d54f065feb9b1ccf0c25de808ff068550d639ec3f58dc66f16cfcaf4fba829fd074c17a02b1af5c11db811229f59cb1deca9e8c0fc84
  • SSDEEP 1536:VKseKSZFwjA2er/0O8/oPKBJAgHFYpExXLE+wEGwqoiClW71r:XXSZ6LeN8/oPKBBHFYWxXo4q0o7V
  • TLSH
    T1ABC3D7954173892CD86C86B811EB2F7817B5AF6A6450C71D4A74F2AD3E333B78C20B57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverynitropersistenceransomwarespywarestealer

  • Family: Nitro

    A ransomware that demands Discord nitro gift codes to decrypt files.

    ransomwarenitro

  • Renames multiple (57) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Sets desktop wallpaper using registry

    ransomware
  behavioral27behavioral28
• • Target
    5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2.exe
  • Size 265KB
  • SHA256 5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2
  • MD5 1f0d38fc9ddcb17fdadd60ad4edf8dab
  • SHA1 b05d811007c28819c81302ce85f4522ec4be3e9b
  • SHA512 0b4c50aad016c3d330a95119a9d8002795661956a79afb7bdbd2c5a46465719442dc06a4a18df3e01b58c3bfa81553d251c2b2232801f22de027876235e1113a
  • SSDEEP 6144:l9jyxFs9ob4OVFVOIwW9PE/z83yTB5xAuFQfaIIoo:ltyxFs9o3EcAzKyTfx9Qf3Ioo
  • TLSH
    T19144AF0AB3A00DF5EC67C27ACD838755EA727C194770D34B125A87A65F233219E3E35A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryazovpersistenceprivilege_escalationransomwarespywarestealerwiper

  • Family: Azov

    A wiper seeking only damage, first seen in 2022.

    ransomwarewiperazov

  • Renames multiple (12467) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral29behavioral30
• • Target
    5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe
  • Size 100KB
  • SHA256 5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc
  • MD5 7fdd3bf8886199e8336f95c88bcaa49a
  • SHA1 77e2019093379de4d5de07dbcf5893831c9bb7ec
  • SHA512 9d774eca21fb33f26991cf20f0f6a2f0bce56aa4cc3d17fd769e0bb767ca400cd5c8dd64bb62db23bf5bc112b91b1a26db7bf2f9d85993cb990be5113e527a40
  • SSDEEP 1536:1zmSA404oATJVPHEMXMxa6CO3/k/hdXVyczH+95DfFFjfuEnm:1zxEYsZaLhdlo95DfFFjfuCm
  • TLSH
    T1D9A3F440D786C12EEBDE32FA956761C04E70B4DB6935C72AACE0A8E519527C17F0D2CB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

  • Renames multiple (199) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Disables service(s)

    defense_evasionexecution

  • Modifies file permissions

    discovery

  • Modifies WinLogon

    persistence

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery
  behavioral31behavioral32