safeboot network ransomware | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
safeboot network ransomware
Size 82KB
Sample200710-1zccsdj7qa
SHA256 58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
MD5 e01e11dca5e8b08fc8231b1cb6e2048c
SHA1 4983d07f004436caa3f10b38adacbba6a4ede01a
SHA512 298bfb9fe55ddd80f1c6671622d7e9e865899a855b5bb8e0d85d8520160cedca6fd8bc72c9881925477bcab883bf6e6f4c69f997b774b74fe992e023a81269de
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

File Explorer

safeboot network ransomware

.exe 82KB

safeboot network ransomware

SHA256 58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
MD5 e01e11dca5e8b08fc8231b1cb6e2048c
SHA1 4983d07f004436caa3f10b38adacbba6a4ede01a
SHA512 298bfb9fe55ddd80f1c6671622d7e9e865899a855b5bb8e0d85d8520160cedca6fd8bc72c9881925477bcab883bf6e6f4c69f997b774b74fe992e023a81269de
MD5 SHA1 SHA512

windows x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.