General
-
Target
fd4f950b_by_Libranalysis
-
Size
750KB
-
Sample
210505-q6b9tjgb46
-
MD5
fd4f950b3c32f5216d76af17f99600c8
-
SHA1
fe09174fb2304d0af10f1a7d588074732aa1fe9b
-
SHA256
b433c270959385ccb4c9f99490c3ef5e6aa56f598f91c0f76bd54878db1fff79
-
SHA512
9dd55aed1276f8a38d021a3b57c4e97f08a1c7d53483f6e7d7de53679f93ea91a29e451f275517a8dd5079bb12fc6ab00e02188d72613ed7e03e12950b70dfc1
Static task
static1
Behavioral task
behavioral1
Sample
fd4f950b_by_Libranalysis.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
fd4f950b_by_Libranalysis.exe
Resource
win10v20210408
Malware Config
Targets
-
-
Target
fd4f950b_by_Libranalysis
-
Size
750KB
-
MD5
fd4f950b3c32f5216d76af17f99600c8
-
SHA1
fe09174fb2304d0af10f1a7d588074732aa1fe9b
-
SHA256
b433c270959385ccb4c9f99490c3ef5e6aa56f598f91c0f76bd54878db1fff79
-
SHA512
9dd55aed1276f8a38d021a3b57c4e97f08a1c7d53483f6e7d7de53679f93ea91a29e451f275517a8dd5079bb12fc6ab00e02188d72613ed7e03e12950b70dfc1
Score10/10-
Modifies WinLogon for persistence
-
Modifies visibility of file extensions in Explorer
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-