Extracted

Extracted

• • Target
    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
  • Size 719KB
  • SHA256 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
  • MD5 8474039d83805eb7b447325c3a8d1ebb
  • SHA1 a07d537f4253745a087709a9a07c449f84deed8d
  • SHA512 3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
  • SSDEEP 12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6
  • TLSH
    T1A0F49E1175C2C032E87309728EBD956E416DF9220B2729DBA3C8065E5FB99F27E36533
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverymedusalockerneshtapersistenceransomwarespywarestealertrojan

  • Detect Neshta payload

  • Family: MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • MedusaLocker payload

  • UAC bypass

    defense_evasiontrojan

  • Renames multiple (155) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1