Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    1a174a556ce8e7a22c66f515ae1591f775bb673e989d5a39334f901edccf5406.exe
  • Size 127KB
  • SHA256 1a174a556ce8e7a22c66f515ae1591f775bb673e989d5a39334f901edccf5406
  • MD5 93a7ed73f2245a1f043b74e724705f54
  • SHA1 6b97b4cd5d44e607540b841081f68b7755ce59f5
  • SHA512 ab1d5999d7bdeb0a2d93a7476cbcace92971417d45a7459fbe294ed66d0466f0e121a68fe9ade89c3c71d4afab3b81b94aaaeabc99e6f02f79c307acbf574090
  • SSDEEP 3072:bhADm5OPINYUsx0Ki6uA9bKHtBdQex7Coy5q5l:bhAcO7xhjuA9bQQzq
  • TLSH
    T18AD3E9883AD5411CE16FCFB069EC6858CE76F5B72525EE0B0D8742871A21BC1DE82E7D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

  • Renames multiple (180) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Disables service(s)

    defense_evasionexecution

  • Drops desktop.ini file(s)

  behavioral1behavioral2
• • Target
    1a247db9ae193938318c1935ebca3e258da2b1ba99902422066df28f4245a002.exe
  • Size 52KB
  • SHA256 1a247db9ae193938318c1935ebca3e258da2b1ba99902422066df28f4245a002
  • MD5 19660b46a1d17197b4f9f77e0e8b2c58
  • SHA1 ca057c6880fe2596193c64150d5f4d4b817be94e
  • SHA512 43614e6589d7c3b444ce19c7922476e2cd1e864d9bf56947d1b2ebd207cecab2a3392f3df8cfbbc67cabb46c218e6320eb8d7a262590fa207542daa098853721
  • SSDEEP 768:1Kau5Zth5ux0XUtULLaFTt2TwomMrBWGYhyyQEQ2+RC6TIqv59z:YauBXkCanhcchyy7QBRC6TIqv59z
  • TLSH
    T11C33CF825440E963DA6B05B8400AE905F7FFFE406537CF83990079997CBD887BAF8D46
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral3behavioral4
• • Target
    1aa9716d4d2bb22285993a195d70565e8ab1420f81f5fd9d90601b4050bddde5.exe
  • Size 3.5MB
  • SHA256 1aa9716d4d2bb22285993a195d70565e8ab1420f81f5fd9d90601b4050bddde5
  • MD5 67ba624e074ac4c20f5edb9ccfb95ab5
  • SHA1 7047f5c03ebd28f024dadec77718ab0e1fcc0ed4
  • SHA512 1bec77f6a73911fad3b15a92e7509554430308fef6f7973eae8485d29c4b9b4c25639f1a55a000ad3ab1ea3946242601bf051347d984bd1f7a03cc138520b2d6
  • SSDEEP 98304:rANJpFHFEGxuIDPB+249X+T5K9Ww2LKKHW:rtGfD0249uT5K9J2
  • TLSH
    T11F062305A590B706C2F465B2FB85C3749E131F5A9800A11324FC3E5FBFEDA4395AAD3A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverypersistenceprivilege_escalationransomware

  • Renames multiple (85) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral5behavioral6
• • Target
    1ab5a24ccad1f77bc4a9c00c32671d19d8350d47bc8408693dbdbd3f30ea3bdd.exe
  • Size 797KB
  • SHA256 1ab5a24ccad1f77bc4a9c00c32671d19d8350d47bc8408693dbdbd3f30ea3bdd
  • MD5 c9293d9e2fa1d7c3385306642cd93561
  • SHA1 cbecf06db239e37ad4bac853316fe998b6499bce
  • SHA512 8a98d9faeffe04367c5c5a68a816ddd6043155c1d6f7d7b96cba3621e7218a0226c9dd078f28f4b854eb23730a8dcf0ade4c9c710f41745115ac61d2b28d0092
  • SSDEEP 12288:T5lkw9HMRhQ2q0K2owuecZk8oKiyRodmc9nz2DGLkxjyQl998Sbmm5+yvYgd:T5lkw9sfqJ7w1KiyRosOz2SLfW9zP
  • TLSH
    T13B0512317582C8B2C0062170C45AFEE02ABE6EF5496855973F95676D2FF72806A7332F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydjvupersistenceransomware

  • Detected Djvu ransomware

  • Family: Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral7behavioral8
• • Target
    1b1172500c6e1e1607b0b0bce4ec74f8b65ffafcd492d8cd2886a7b7f20efaa4.exe
  • Size 50KB
  • SHA256 1b1172500c6e1e1607b0b0bce4ec74f8b65ffafcd492d8cd2886a7b7f20efaa4
  • MD5 e0870a190c5eaefdae56f9c8773e36cd
  • SHA1 a0d2ea755f3914354b76ed895e0024fe753808bc
  • SHA512 c68948866b06f2336b4be9ea6ec63daa3573d9a5a8185977e772bfd297a0b7cbf050fd5cc72cb782f53a4ba1bb7d46b683b7a3fcd69e047d0e30899e021efadd
  • SSDEEP 1536:TvbFNKSxZ3lAC2MwbF+dWlPeZzZ/bOyA65T8HAy2xp18LKgBW+:TvbFNKSxZ3H2MwbskmzZ/bOyAcOaoW+
  • TLSH
    T17533D4157FD44226E1BB1B3A18B342103B77BA534D32C65EA59F620E2B237D84893F76
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionimpactransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (1972) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral10behavioral9
• • Target
    1ba708ad9103142f4b223b87537641cff1a36ca1c60bf8c8f1fae91d2bac4e02.exe
  • Size 207KB
  • SHA256 1ba708ad9103142f4b223b87537641cff1a36ca1c60bf8c8f1fae91d2bac4e02
  • MD5 43f1d14af2df62649c0b431d5d964482
  • SHA1 cee18c540b1ec1f2563ff343bbf7153f84529d7e
  • SHA512 b261f1758eb7520fa773e2d3a8c0e1f4ec468d36f22f0fc21d708906fc7e4c6f3d4ae8edad7e32284b6e98cbb3e482ddda99cc0bf7ec11aedb779531e102769b
  • SSDEEP 3072:nM+lmsolAIrRuw+mqv9j1MWLQKMTmmsolNIrRuw+mqv9j1MWLQS:M+lDAAYTmDAN
  • TLSH
    T1D92415F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryhiddentearransomwarespywarestealer

  • Detects HiddenTear Ransomware

  • Family: HiddenTear, Cryptear

    HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.

    ransomwarehiddentear

  • Renames multiple (246) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral11behavioral12
• • Target
    1bd7643d238ab9176be8ac19f972d1e734f400e1ec9d77140ec29f6d71d33ebd.exe
  • Size 47KB
  • SHA256 1bd7643d238ab9176be8ac19f972d1e734f400e1ec9d77140ec29f6d71d33ebd
  • MD5 41a3e7ffe4223bd30f8cb0d6245ac8e8
  • SHA1 15f173f88af678e574fa20006188217b0d5dc455
  • SHA512 bb7b6ffffe408fd7d78b37fc9aaf8bad64e0fdd28e4e8b59187b2b6b4420823e59f003bd3d2b058af4dbe4118b28fb26bf4eb99868b83cb00f33f6b52e2a0b8c
  • SSDEEP 768:euwCfTg46YbWUn8jjmo2qrq3QfnxPIcWqWOCv0bcU+uMqZPvf17BDZMx:euwCfTgp/2KucWBpsbcUxMUdtdMx
  • TLSH
    T1F0232A003BE9816BF2BE4F78A9F2224585B6F1273603D55D2CC441D75B23BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  behavioral13behavioral14
• • Target
    1bdbb1f54354640bd65ec045ce886ab963d80fa2a96503f16f54f25484759ed1.exe
  • Size 214KB
  • SHA256 1bdbb1f54354640bd65ec045ce886ab963d80fa2a96503f16f54f25484759ed1
  • MD5 6627486ab7443b9867e274355651c071
  • SHA1 389f9b6d6b8d3dff216b0d008990e16db25fdcf7
  • SHA512 e91f05843cc777a3b5ba28c7841c0076de64c1f9bb025646fa5df589d97f898b1c4aedcfddad74566cef7858ebaba065dfada041b0d334fd45f51a8939becca0
  • SSDEEP 3072:fRM+lmsolAIrRuw+mqv9j1MWLQCMTmmsolNIrRuw+mqv9j1MWLQA0d:fK+lDAAYTmDANS
  • TLSH
    T1FA2425F1A740C465D8A796B9843BDAA7A423A24EDC6C490D3C92FF0B7D723474027D9B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryhiddentearransomware

  • Detects HiddenTear Ransomware

  • Family: HiddenTear, Cryptear

    HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.

    ransomwarehiddentear
  behavioral15behavioral16
• • Target
    1c180f8f480b87a62ffdfbd4dc32ac664e6913d03b112fd3df780bb9f821a78d.exe
  • Size 424KB
  • SHA256 1c180f8f480b87a62ffdfbd4dc32ac664e6913d03b112fd3df780bb9f821a78d
  • MD5 bf6f7ef2802705565d33ad4c9225acda
  • SHA1 d9a921d6e4f0d206e646700513eda143db239635
  • SHA512 4151218298bf9111465b4b5d140f85abc01872cad4b54dbdefb2e061cbc4f09b6c03f4c6fe202f6034c2e41b70ee754be4bf5cefb15b902ac0b1a966cb916ec3
  • SSDEEP 6144:JHEmrnWIHf5Kt4m6bkyotM4dxtsXgrNfl0EUl0srjnLoL:JHEmjH/5KtEbkRtM0jflnUWILoL
  • TLSH
    T108942A2570829AEAEDB554751A64FBFDA92CB4B00BA40EF7B3C649B404E03C26774F13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsevenpersistenceransomwarespywaretrojanupx

  • Detects Seven ransomware

  • Family: Seven, SevenCrypt, 7ev3n

    Seven aka SevenCrypt or 7ev3n is a ransomware.

    ransomwareseven

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral17behavioral18
• • Target
    1c753941a2ae4758505208a8a1e73b3ab686627e04be298fe888267be449bbb4.exe
  • Size 1.9MB
  • SHA256 1c753941a2ae4758505208a8a1e73b3ab686627e04be298fe888267be449bbb4
  • MD5 02a6ac2c4f9e515af6deefb9601bea32
  • SHA1 2dcf722561e0b2654eeb00ec0d0343eeacec9792
  • SHA512 fb49dd25ed837244b7ee5bda59474c10685a90ffa0add5008ed6ade7ef57b5f4f9ead778b08b72933432557a7f55d5bd073ea400efa0a3903460ee24bf6443ba
  • SSDEEP 49152:dnvxzYd1xC0AtzdNVlitpUXpn2tPl+zE1HwmfJ:dnvxEd1xtm/ni7UXp2n+zv
  • TLSH
    T18395CF03FBC688B3D5971538516BA73F493BAA105328C6D3C7D02D66AD322D1A63F3A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

  • Clears Windows event logs

    defense_evasionransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Modifies WinLogon

    persistence

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral19behavioral20
• • Target
    1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe
  • Size 55KB
  • SHA256 1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce
  • MD5 796e90187c74f7222087d8980c11d37e
  • SHA1 c6cc5262ccf23915805e3ea50888eb7f1ec8abc3
  • SHA512 c1f802448f1cf55bb3d5800a9d3431a17f97d54e40b1815257b02b255fe2ed7cd1ceade307d56dfa6c44f40ef048da2096a4e87f262d4287359ef694a487c7fb
  • SSDEEP 1536:tNeRBl5PT/rx1mzwRMSTdLpJy8DFBhoj+:tQRrmzwR5J1DF5
  • TLSH
    T1A343BF0770A984B3CE7145B0263A3F5B4FBEA10544B4848B8F3A5D963FD4476D72A3BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryevasionexecutionphobosimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (830) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral21behavioral22
• • Target
    1cce1bc76926ba1ae87ce914b89a79b32fc03b427d7c7f5e002b3a5d8b134d95.exe
  • Size 4.7MB
  • SHA256 1cce1bc76926ba1ae87ce914b89a79b32fc03b427d7c7f5e002b3a5d8b134d95
  • MD5 2803a5031133c41db8621b6f2fabff04
  • SHA1 f8aeec4ab0ce0b6c2bd3f60686a8a4ee5dfbecef
  • SHA512 efb3a008607615defc00a8a8f0b990393856eab0d8569413aabfab17ea08a7098ac0c4963b7bf9311bdf5dede8ee17e985e1c97dd88538ac4ee20d47ca7e1a39
  • SSDEEP 49152:ZjLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:xLu1TIRtUOV5Zv
  • TLSH
    T1E4365B05B7D88526D0BF4739587393842371FC939D23876F31A0A26E7E727908D92B7A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnominatuscryptopersistenceprivilege_escalationransomwarespywarestealer

  • Detects NominatusCrypto C# variant

  • Detects NominatusCrypto DOS executable variant

  • Family: NominatusCrypto,NominatusStorm

    NominatusCrypto aka NominatusStorm is a ransomware written in C#.

    ransomwarenominatuscrypto

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral23behavioral24
• • Target
    1d2a840a0c217cb4721160ed3e34051ddff1e131179931fcff6477ef3cd44c4d.exe
  • Size 23KB
  • SHA256 1d2a840a0c217cb4721160ed3e34051ddff1e131179931fcff6477ef3cd44c4d
  • MD5 9fc6a55ccc1cd41930b17c7dd4474bab
  • SHA1 2629a5b422be012ebf5bc84c73a7003801e58f8f
  • SHA512 25ae1f8b99309bc268eedfff67cd5c4c7a984ef8732f093bbd14f61172a3dfa8ca1029c0bf7ed927eaf2e7a59dd7f21cea605660d29170a9ae7f4281c5a478e8
  • SSDEEP 384:o3Mg/bqo2mcxtivpTUc3LTAzk0J2r91C+Dxb5De3:Wqo2ptMpTLbTzc2r9Fxbhe3
  • TLSH
    T188B2C41867FA4A39F6FB1F7C2DB220505B75B897ED3DC74D188A004D0922B9CCDA0B66
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionchaospersistenceprivilege_escalationransomwarespywarestealer

  • Chaos Ransomware

  • Family: Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral25behavioral26
• • Target
    1d5f8c4e2cb635bb5cfb001dfd0db882b9eeea700f04a6b9cb1a934667b85368.exe
  • Size 79KB
  • SHA256 1d5f8c4e2cb635bb5cfb001dfd0db882b9eeea700f04a6b9cb1a934667b85368
  • MD5 2cd19f67df6d9e1a42e9893e3813b459
  • SHA1 308b02416b9930bfc1d3fbbef9d184dcbf5714b4
  • SHA512 1b77d760ba626308fd67572189821b7c97bf619495da7bd063fe35ee5eceedfe08dfbee02b9d26381b23cdab848bcad27a56632b89a702bb9cac1e5026de5304
  • SSDEEP 1536:m6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:ghZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
  • TLSH
    T15E83D8115945D2B6C5D232318167F1AAC13A197003B5B78B63C027AEFB10AE8F6BCF67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionbabukimpactransomware

  • Family: Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

    ransomwarebabuk

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (171) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral27behavioral28
• • Target
    1d9d70b76d21cd31232d5087ee3452c7170be5d7dad2d5bc4fffc2e8279edde3.exe
  • Size 182KB
  • SHA256 1d9d70b76d21cd31232d5087ee3452c7170be5d7dad2d5bc4fffc2e8279edde3
  • MD5 6b8c2b5aeb95e42aa34d9c16882ca86e
  • SHA1 3c6cd3fdd2cd6b6af1f935cd4c72d96f625f64b4
  • SHA512 dbf71640c8557b9159af8c2922c62ef8af3e3a7dbb9429ad8027a799385305ec4fb9d82bf805f16cb54cbf6f23298a334080081f949c9b455fcaffcd81f9ed7d
  • SSDEEP 3072:tuTO4rRZimevXLmGx4XscjeU39Fq+ZDPUEMTlqmZokzV2dr6JAi2dS:tkZVevbmGxcAs9HZDPFMTh+LdrAAi2dS
  • TLSH
    T1D904AE57B7F4006DD076D2B6C8B6471697B1BC010B3193DF26A9869AAF33BE49D34322
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryazovpersistenceprivilege_escalationransomwarespywarestealerwiper

  • Family: Azov

    A wiper seeking only damage, first seen in 2022.

    ransomwarewiperazov

  • Renames multiple (12949) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral29behavioral30
• • Target
    1da7b7bfe3686ca9cf391a2bd070b8d0ee28d26163cd91d93b1a5fd8df64fe89.exe
  • Size 67KB
  • SHA256 1da7b7bfe3686ca9cf391a2bd070b8d0ee28d26163cd91d93b1a5fd8df64fe89
  • MD5 b8cfd0b952c117716223af4b96a5bc37
  • SHA1 07f58396c18c346691731458350555a0898515cc
  • SHA512 fe4b3e57012ad85ea7e311afda0c51948994d9dd4a5c0807390b1a06724e14b89481d5c918a2c0c4ad194b8062d9aac794f8faeba27db7fd2b42a16f8ae44ee6
  • SSDEEP 1536:WP2s8TjyKaW5R4LgIh7O2ECe/t0bezIA6ikKVxhlpwVcl:VhjyrW5R4L/h7OQKFIA6ikKVxjpqY
  • TLSH
    T190631F9D726072EFC867C472DEA81D68EB5134BB931F4213A06715ADAE4D89BCF140F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverypersistenceransomware

  • Modifies WinLogon for persistence

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral31behavioral32