Overview

overview

10

Static

static

95a0cdecb7...6e.exe

windows7_x64

10

95a0cdecb7...6e.exe

windows10_x64

10

Resubmissions

11-02-2020 15:08

200211-yh5d2v3rpa 10

11-02-2020 13:53

200211-smh4fqemta 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

  • Size

    986KB

  • Sample

    200211-smh4fqemta

  • MD5

    934984b11e6690c10e7ad5bf1f0cf274

  • SHA1

    5c826f0bca1460508b0a3db4b0e5f9fbd7c2104f

  • SHA256

    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

  • SHA512

    4cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e

Score
10/10
ouroborosxmrigevasionminerransomware

Malware Config

Targets

    • Target

      95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

    • Size

      986KB

    • MD5

      934984b11e6690c10e7ad5bf1f0cf274

    • SHA1

      5c826f0bca1460508b0a3db4b0e5f9fbd7c2104f

    • SHA256

      95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

    • SHA512

      4cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e

    Score
    10/10
    ouroborosxmrigevasionminerransomware

    • Ouroboros/Zeropadypt

      Ransomware family based on open-source CryptoWire.

      ransomwareouroboros

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Modifies Windows Firewall

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks