rBlbqI2.exe

General
Target

rBlbqI2.exe

Size

291KB

Sample

200501-pez84yzjvx

Score
10 /10
MD5

2fec9bf50de5395f799b23a1099b10d6

SHA1

6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e

SHA256

df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763

SHA512

5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8

Malware Config
Targets
Target

rBlbqI2.exe

MD5

2fec9bf50de5395f799b23a1099b10d6

Filesize

291KB

Score
10 /10
SHA1

6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e

SHA256

df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763

SHA512

5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8

Tags

Signatures

  • Jigsaw

    Description

    Ransomware family first created in 2016. Named based on wallpaper set after infection.

    Tags

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run entry to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Drops desktop.ini file(s)

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Tasks

                      static1

                      behavioral1

                      10/10

                      behavioral2

                      10/10