857e65a956b9311a825480129f3ae1e56b9471667fd7bd35825de18c46a95901

General

Target
minecraft-mod-obfuscator.zip
Size 9KB
Sample261104-wv2e6ab19v
SHA256 857e65a956b9311a825480129f3ae1e56b9471667fd7bd35825de18c46a95901
MD5 edc25a7a5fd93ca30f3dc2d1d2bde302
SHA1 54b09ae1b8d4384c09da07a80aeade8ad76fd48e
SHA512 6591562a50221a30c0f8b28140d710f03f24a07e9b3e5162b6e7d489a569beb0ac7717b1c769dd868fc96c37c871c53ef166713d53b398889b05ec8109d5dbe9
SSDEEP 192:P7QNfAY7Dzt9f5GEWmFHkwjgb1iZgkA121qxWD0bLA8GT:P7Q93rHXpJANxbLA9
TLSH
T142121909DB5A1BABEC2DE73C3568E0BEC1B7C83F6190458651193981B98BCA40B5C23F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  minecraft-mod-obfuscator.zip
- Size 9KB
- SHA256 857e65a956b9311a825480129f3ae1e56b9471667fd7bd35825de18c46a95901
- MD5 edc25a7a5fd93ca30f3dc2d1d2bde302
- SHA1 54b09ae1b8d4384c09da07a80aeade8ad76fd48e
- SHA512 6591562a50221a30c0f8b28140d710f03f24a07e9b3e5162b6e7d489a569beb0ac7717b1c769dd868fc96c37c871c53ef166713d53b398889b05ec8109d5dbe9
- SSDEEP 192:P7QNfAY7Dzt9f5GEWmFHkwjgb1iZgkA121qxWD0bLA8GT:P7Q93rHXpJANxbLA9
- TLSH
  T142121909DB5A1BABEC2DE73C3568E0BEC1B7C83F6190458651193981B98BCA40B5C23F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan
- Renames multiple (309) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2