Extracted

• • Target
    maytero emu.exe
  • Size 5.7MB
  • SHA256 e4dbe8521ef8a770f00c4813698bafbd106bce8a8fde40f2556ee87383a082de
  • MD5 9c07fe314e0f5378a7fb96be0f1ce72d
  • SHA1 c0d0de6e852868df0c98db89665bdc914a5e723f
  • SHA512 5fc13f740cbbedf1d44ac5e07d3298677f006fff40b5e0abb78133719670b7c8558ff692fd300404a2f82d4719f829f19e4548a101fc8d8cbb1476c69b291f0f
  • SSDEEP 49152:a9O1PUjrFCGha6Z0xdb0RChAzLlfrFgV6VBexIVcILT0HLbo8D1D7GoCkrUXFG12:aSU3FtxCzwR3rWV4exIx0uDFX5hH+JW
  • TLSH
    T193566C03F6A641EDC16AC074871AA233FB72B85907217AEB56D08A353F62FD05B7E714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerevasionimpactransomwaretrojan

  • Deletes NTFS Change Journal

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (513) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Deletes System State backups

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Creates new service(s)

    persistenceexecution

  • Disables service(s)

    defense_evasionexecution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2