Overview

overview

10

Static

static

da2d865045...ec.exe

windows7_x64

6

da2d865045...ec.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da2d8650452e6d1f8eaaaadac6b9ff015c99615d4e0b97ede0d462f1ed91f3ec

  • Size

    880KB

  • Sample

    210515-3d3txfglhn

  • MD5

    ba92eb82a0d8e11e398699805443ddfb

  • SHA1

    1be55fa2dfb0d523160a96294f15f08d5af65808

  • SHA256

    da2d8650452e6d1f8eaaaadac6b9ff015c99615d4e0b97ede0d462f1ed91f3ec

  • SHA512

    24e59f57f059e683abf567c77b78d7899888c8c8f419aa1429e2d22b6c01b6d835a7d532d4c58e0a075dc9b41bd959df3c06f1239fd32ccbd071e672275764f3

Score
10/10
badrabbitransomware

Malware Config

Targets

    • Target

      da2d8650452e6d1f8eaaaadac6b9ff015c99615d4e0b97ede0d462f1ed91f3ec

    • Size

      880KB

    • MD5

      ba92eb82a0d8e11e398699805443ddfb

    • SHA1

      1be55fa2dfb0d523160a96294f15f08d5af65808

    • SHA256

      da2d8650452e6d1f8eaaaadac6b9ff015c99615d4e0b97ede0d462f1ed91f3ec

    • SHA512

      24e59f57f059e683abf567c77b78d7899888c8c8f419aa1429e2d22b6c01b6d835a7d532d4c58e0a075dc9b41bd959df3c06f1239fd32ccbd071e672275764f3

    Score
    10/10
    badrabbitransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks