53e7962704aadbd6f5d0dceee8b60c759a27a9d62dfab6893f7d754aad5f89ea

General

Target
תוכנה לדוקסים.exe
Size 67.6MB
Sample261029-zb32ests5l
SHA256 53e7962704aadbd6f5d0dceee8b60c759a27a9d62dfab6893f7d754aad5f89ea
MD5 e073df6758a9efcf8dad1df0e1061048
SHA1 3e7ce4f8e1453d94b046be0ed8354fe91481272d
SHA512 6b79ff6416b66aa9925254d63f94f1783cec55b6cc6a714496fd26f43918d41cab767bda767d3865fcab01c3706544f479ada0a0ec7ca92699615b1b1f244679
SSDEEP 1572864:QM16ybhZG7rznDSgbMZsmNrQZ9v9eEL83rMPeqT14SaRYomZ:QM1fWbDShsoELarMmq5/sYJ
TLSH
T122F73368A5821CADC499803BBD1536E077EE3CEF128411E253BEF1565C37B85AEAF04D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  תוכנה לדוקסים.exe
- Size 67.6MB
- SHA256 53e7962704aadbd6f5d0dceee8b60c759a27a9d62dfab6893f7d754aad5f89ea
- MD5 e073df6758a9efcf8dad1df0e1061048
- SHA1 3e7ce4f8e1453d94b046be0ed8354fe91481272d
- SHA512 6b79ff6416b66aa9925254d63f94f1783cec55b6cc6a714496fd26f43918d41cab767bda767d3865fcab01c3706544f479ada0a0ec7ca92699615b1b1f244679
- SSDEEP 1572864:QM16ybhZG7rznDSgbMZsmNrQZ9v9eEL83rMPeqT14SaRYomZ:QM1fWbDShsoELarMmq5/sYJ
- TLSH
  T122F73368A5821CADC499803BBD1536E077EE3CEF128411E253BEF1565C37B85AEAF04D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence ransomware spyware stealer
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Clears Windows event logs
  defense_evasion ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Possible privilege escalation attempt
  exploit
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1