Overview

overview

10

Static

static

10

skynet.exe

windows7_x64

10

skynet.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    skynet.exe

  • Size

    678KB

  • Sample

    210129-3m4sl1alsx

  • MD5

    115b22d9cff82d75c28e43f83f55c663

  • SHA1

    8c0c54194a88551feec78c5a8416411ed17c4fce

  • SHA256

    fbf6c8f0857d888385f6bc0d46523ebcc1634e06d0e96411fc43a8ae4213d1f3

  • SHA512

    9f1a50d735fb30ca0464ad8746929c416d5fee3ee14dfb2fab43abb3e7000e0bf478dc337b8e4fe6c2f8ec6fc2ccc17b73c9429df6799bc91faa04710a0051de

Score
10/10
medusalockerevasionransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      skynet.exe

    • Size

      678KB

    • MD5

      115b22d9cff82d75c28e43f83f55c663

    • SHA1

      8c0c54194a88551feec78c5a8416411ed17c4fce

    • SHA256

      fbf6c8f0857d888385f6bc0d46523ebcc1634e06d0e96411fc43a8ae4213d1f3

    • SHA512

      9f1a50d735fb30ca0464ad8746929c416d5fee3ee14dfb2fab43abb3e7000e0bf478dc337b8e4fe6c2f8ec6fc2ccc17b73c9429df6799bc91faa04710a0051de

    Score
    10/10
    medusalockerevasionransomwarespywarestealertrojan

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker Payload

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks