General
-
Target
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.zip
-
Size
5.4MB
-
Sample
200804-n3qesrh822
-
MD5
dece67156f31fcbf291c325b10bb9d57
-
SHA1
ba93ca2d224ba6feee2983297033d67805f33b6c
-
SHA256
4cb3cc8e7d2d712c43268d8a56e20dee3a1f40d580237115992307a5037b991e
-
SHA512
0396902e91c09beb5b26b54a932c881992e884566d5c125bb4b37a3de3954911891fa447cb5a86098c85d7618883fe27d5b1aa32a405d91e39f488bc3916f668
Static task
static1
Behavioral task
behavioral1
Sample
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
Resource
win7
Behavioral task
behavioral2
Sample
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
Resource
win10v200722
Malware Config
Extracted
C:\Documents and Settings\read_me.txt
Extracted
C:\Boot\bg-BG\read_me.txt
Targets
-
-
Target
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
-
Size
5.7MB
-
MD5
e3204b2e61223989b1562f5dee40eee0
-
SHA1
7bd50a3b0e3f9b4a543f750869ca3ee29b4798e1
-
SHA256
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64
-
SHA512
19df0eb4c803e6eeb41abb1fb425f4d9cd6e4262aaeb8bbf7eb959a30f3db2533fd6aed13e055a9781371e9de37de4212d80a32862798368e5dd798763012bc4
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-