870c64fc6cb4648a502492ce5e2de2cc536a25ed5e1c5061d29f6a288507c6b0

General

Target
Priv es.exe
Size 89.0MB
Sample261012-vd3q8at19l
SHA256 870c64fc6cb4648a502492ce5e2de2cc536a25ed5e1c5061d29f6a288507c6b0
MD5 b82cf7678dc476935df4a032f48f1031
SHA1 a02e2dbfce73a603da4b42a51c9687be5b7ad50e
SHA512 657a084e5dcfc50e1d71b87130bae1432ad3926c3fc38cbc3437a9ecf889c47edee7173c93208901336377293bb7dfebe6831aad13e97d623d147689bb299d5c
SSDEEP 1572864:q4guKWzmluKCb5VPWNT6kuRfGyu834GGkGvUcQbMRxusM2M/oV3bZflzqWab9M7S:q4gTYXkOmEYUhWxBM2es3bZflzqWaMS
TLSH
T17D1833C5B0E5C83DF88DE4AF47333EB3881E9E150E74B6ABDC3D1D820D6958A91668D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Priv es.exe
- Size 89.0MB
- SHA256 870c64fc6cb4648a502492ce5e2de2cc536a25ed5e1c5061d29f6a288507c6b0
- MD5 b82cf7678dc476935df4a032f48f1031
- SHA1 a02e2dbfce73a603da4b42a51c9687be5b7ad50e
- SHA512 657a084e5dcfc50e1d71b87130bae1432ad3926c3fc38cbc3437a9ecf889c47edee7173c93208901336377293bb7dfebe6831aad13e97d623d147689bb299d5c
- SSDEEP 1572864:q4guKWzmluKCb5VPWNT6kuRfGyu834GGkGvUcQbMRxusM2M/oV3bZflzqWab9M7S:q4gTYXkOmEYUhWxBM2es3bZflzqWaMS
- TLSH
  T17D1833C5B0E5C83DF88DE4AF47333EB3881E9E150E74B6ABDC3D1D820D6958A91668D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer upx
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (1976) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1