Overview

overview

10

Static

static

Cats.exe

windows7_x64

10

Cats.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cats.7z

  • Size

    161KB

  • Sample

    210329-slgandykx6

  • MD5

    dc780dea1e4090e793eab71ab53ff120

  • SHA1

    8d9cf3e7a9d6cdb70c5c0a6274008f27f01ca416

  • SHA256

    bda65b6470b131bdcdb811a8c95e4498c15641dd97b9af9e3dd65ff82ac1a69a

  • SHA512

    085a56404934fb54cdd4a6941e81c7e988e6eb4d66fd9158bf57d8767a42ae01b73a09b0c227af3897dbc06c477b92c1909264d9b0d6177030df32b56301db6c

Score
10/10
jigsawpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      Cats.exe

    • Size

      187KB

    • MD5

      d3be36fa40f8ead25681fab7a9a0af12

    • SHA1

      7a4fd7bccee34bb435126e8ab600277c8e1e9440

    • SHA256

      79193fb1b7ab2698ddd617aa24fa64c08235851a78245d066e6fde02b73856ca

    • SHA512

      c50fbc039a0e15cdac8823174297ebc35772fa40f4a56d89847b5f982db7075d5918f622efb9b3b3b8aa76159fcc68febcb8d3c2bb52040beb351a141afb0dc0

    Score
    10/10
    jigsawpersistenceransomwarespywarestealer

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

      ransomwarejigsaw

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks