ouroboros | a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461

General

Target

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
Size

994KB
Sample

200911-3wb7tfrw2j
MD5

62ae12ef05bb6ad38cf30d8c35efd416
SHA1

90049acd442225de16124a89835eed61f4202a8b
SHA256

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461
SHA512

0114ca7c03291783732a2cbcbbbc4f6a2250c3ad41aaa415be6e85aa28daad85b668f4f0177357c3fdf1c861830bb8b24d378390de7736a57660182ac3c3709a

Score

10^/10

Malware Config

Targets

- Target
  
  a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
- Size
  
  994KB
- MD5
  
  62ae12ef05bb6ad38cf30d8c35efd416
- SHA1
  
  90049acd442225de16124a89835eed61f4202a8b
- SHA256
  
  a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461
- SHA512
  
  0114ca7c03291783732a2cbcbbbc4f6a2250c3ad41aaa415be6e85aa28daad85b668f4f0177357c3fdf1c861830bb8b24d378390de7736a57660182ac3c3709a
Score

10^/10

ouroboros xmrig evasion miner ransomware spyware
- Ouroboros/Zeropadypt
  Ransomware family based on open-source CryptoWire.
  ransomware ouroboros
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ouroboros/Zeropadypt

xmrig

Drops file in Drivers directory

Modifies Windows Firewall

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Looks up external IP address via web service

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2