General
- Target PrimeToolX.exe
- Size 4.4MB
- Sample261110-zea5taba33
- SHA256 07448cd9e195d876a34e8ceb22bb03abfc7dc70ab5f43456136d8b4ac49a525d
Score
9/10
Malware Config
Targets
-
- Target PrimeToolX.exe
- Size 4.4MB
- SHA256 07448cd9e195d876a34e8ceb22bb03abfc7dc70ab5f43456136d8b4ac49a525d
Score9/10Renames multiple (63) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Executes dropped EXE
Loads dropped DLL
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Drops file in System32 directory
-
- Target PrimeTool.pyc
- Size 13KB
- SHA256 33152f17d3371c8c8057b229a6139dd5eb765a5e802b2e190959cfd8cd8f1d73
Score3/10