35a86a0820ef7e4dc1239e9a94ef4a20edecd1dfcb62c70ef041a1b6b00aa281

General

Target
ofx.exe
Size 658KB
Sample261102-rxddwscy6m
SHA256 35a86a0820ef7e4dc1239e9a94ef4a20edecd1dfcb62c70ef041a1b6b00aa281
MD5 e2244a6390be51b49dca1b4ef769c8e9
SHA1 c5c134852e65e59abb8928f26b5f956adb0e6f8a
SHA512 e2955bcf9a280243cd5a8ee84f9d0fda7ff7b2fb118e1d8ad706f9bc79b5a9b9d028aa9c1ccc8038cc37d9032904c5c4c61f94be076768a1142558e7145bf632
SSDEEP 6144:lGeaj65P/HCMfIrwRmw3usvKC5l9G1WnQckeUmtkanhqw17kVXWMdps2gFRwrLDQ:7L3tErPEtRPZgKjqOU/bWH
TLSH
T17BE47D25DAA402FCE273D2B5EE675812F772784B13316DDB038055661E27AD88B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ofx.exe
- Size 658KB
- SHA256 35a86a0820ef7e4dc1239e9a94ef4a20edecd1dfcb62c70ef041a1b6b00aa281
- MD5 e2244a6390be51b49dca1b4ef769c8e9
- SHA1 c5c134852e65e59abb8928f26b5f956adb0e6f8a
- SHA512 e2955bcf9a280243cd5a8ee84f9d0fda7ff7b2fb118e1d8ad706f9bc79b5a9b9d028aa9c1ccc8038cc37d9032904c5c4c61f94be076768a1142558e7145bf632
- SSDEEP 6144:lGeaj65P/HCMfIrwRmw3usvKC5l9G1WnQckeUmtkanhqw17kVXWMdps2gFRwrLDQ:7L3tErPEtRPZgKjqOU/bWH
- TLSH
  T17BE47D25DAA402FCE273D2B5EE675812F772784B13316DDB038055661E27AD88B3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (9968) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables use of System Restore points
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral1