Extracted

• • Target
    env.npl
  • Size 4KB
  • SHA256 0b501207a977f9b9f55253eb3d3294aa6ce22054ba6a0ca9d51725175bd67658
  • MD5 d1bcd982b9e4f628da56b0b75c5def0f
  • SHA1 8b67128764aec7206d7289024f26a609969fe8a6
  • SHA512 1ee7ac97604ab3c8da56dc1e2f8980ffd2ba9a634d272c9fe1c86c29aa99191da037345ffac3404096fc536518c45808788563ad839dc237ea30908217417a30
  • SSDEEP 96:R9lvSfTq9dn8ICIinKsv25jq/PJ9rApEj4/TIvJ4iliHiIigtqPZT:9vSfTS8ICIEKsv29q/Hy/TAJrlOiIfqN
  • TLSH
    T1EDB1645C7DE61CBC0381A1FA4A3B24969925FD453C4AF2C5D094E6D13D61E4C82A3F7D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoveryexecutionransomware

  • Executes dropped EXE

  • Loads dropped DLL

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1
• • Target
    node-v26.12.1-x64.msi
  • Size 35.2MB
  • SHA256 f32a2844504ed8d73449ddb480385f69cb436bc9409a89e2049ae83447078457
  • MD5 9e8cd461377b8365814ba5f75860a261
  • SHA1 794b81a14887a89480ef94997f7f9867c6a3f4c0
  • SHA512 474c9b6290373083976acf58cb0d74c2ec6a05b06fc28401ae22d8c8b5d9fc1c611561128e70174be39c9e08fb2e1ca01936a7b266c9517f66fd96bddaa0e55e
  • SSDEEP 786432:iQFREph06HP9fp9iHgszulv7ysx2CO5JyByKVN2U:iQN6HP9feAOulv7ysgDyNp
  • TLSH
    T142873327FAD25972C5AA4131D4638395AB7A7D283710069E46B4B05CFE362F06FFB702
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistenceprivilege_escalationransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral2