0a365240a36f0958331bb5c9f022d78b816edd66ee25baf4445e7a5421bb75eb

General
Target

0a365240a36f0958331bb5c9f022d78b816edd66ee25baf4445e7a5421bb75eb

Size

943KB

Sample

201203-34zxrv862j

Score
10 /10
MD5

1062b0544beb5457fb6fe2b42a5d279d

SHA1

e0802b7dc9034902afbbe8ce4a2f8a107278b32b

SHA256

0a365240a36f0958331bb5c9f022d78b816edd66ee25baf4445e7a5421bb75eb

SHA512

2910ecf620c20672c440a647045f91512f17b16a11a701a667f29f17d24b0bf8f8aa56ebcda39111fd72ed9e8dec159622f205da18e31a06bbd84bed654b5b5d

Malware Config
Targets
Target

0a365240a36f0958331bb5c9f022d78b816edd66ee25baf4445e7a5421bb75eb

MD5

1062b0544beb5457fb6fe2b42a5d279d

Filesize

943KB

Score
10 /10
SHA1

e0802b7dc9034902afbbe8ce4a2f8a107278b32b

SHA256

0a365240a36f0958331bb5c9f022d78b816edd66ee25baf4445e7a5421bb75eb

SHA512

2910ecf620c20672c440a647045f91512f17b16a11a701a667f29f17d24b0bf8f8aa56ebcda39111fd72ed9e8dec159622f205da18e31a06bbd84bed654b5b5d

Tags

Signatures

  • ostap

    Description

    Ostap is a JS downloader, used to deliver other families.

    Tags

  • Blocklisted process makes network request

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks

                    static1

                    behavioral1

                    10/10

                    behavioral2

                    10/10