cd4aef762ba8d224fc9d4534b15bfc0a5c15c2656312fc925a1d1710ae39e263

General

Target
LoaderR.com
Size 13.7MB
Sample261014-es89jsed76
SHA256 cd4aef762ba8d224fc9d4534b15bfc0a5c15c2656312fc925a1d1710ae39e263
MD5 2d902f38a790949505533fa0dfe4441a
SHA1 88305383f812306a0c5b0dd25e6b26f51d0f62b5
SHA512 7d7833cc230087d4b474ce61523e1e6978b2686fab820ec364cc979c07356966564a4f0dadcf37b95132fc632f121c0f91ba4f4e1bd784bc5b62f51b6c1a2092
SSDEEP 393216:03fOCdGafHBgqBHOkWZqM4CCvUwuMiW5yssem0ylhp:OfhdGaGqeZqM41saysZmX
TLSH
T1A5E63353ED9DB5B0E4A24F78F046536A3570B90D8E7E8B3D67C1681022225FAE44E9F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  LoaderR.com
- Size 13.7MB
- SHA256 cd4aef762ba8d224fc9d4534b15bfc0a5c15c2656312fc925a1d1710ae39e263
- MD5 2d902f38a790949505533fa0dfe4441a
- SHA1 88305383f812306a0c5b0dd25e6b26f51d0f62b5
- SHA512 7d7833cc230087d4b474ce61523e1e6978b2686fab820ec364cc979c07356966564a4f0dadcf37b95132fc632f121c0f91ba4f4e1bd784bc5b62f51b6c1a2092
- SSDEEP 393216:03fOCdGafHBgqBHOkWZqM4CCvUwuMiW5yssem0ylhp:OfhdGaGqeZqM41saysZmX
- TLSH
  T1A5E63353ED9DB5B0E4A24F78F046536A3570B90D8E7E8B3D67C1681022225FAE44E9F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution upx adware persistence ransomware spyware stealer
- Renames multiple (100) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2