Overview

overview

10

Static

static

8

2049191a8e...70.exe

windows7_x64

8

2049191a8e...70.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670

  • Size

    434KB

  • Sample

    210515-9k8q54t12j

  • MD5

    b5d4146d585d33490dca0e55682b2492

  • SHA1

    280386782e0dfad5991a218e1601ec5ca7ebc67b

  • SHA256

    2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670

  • SHA512

    31a9b11b9ffeb1fa4c8b10827917c99caf501276c5f55456bd1b2249f67926ccc011327c92722e8c4f7360f39b6e0d02895f705bf21d49bc4c12d29a425d8ab0

Score
10/10
badrabbitpersistenceransomwareupx

Malware Config

Targets

    • Target

      2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670

    • Size

      434KB

    • MD5

      b5d4146d585d33490dca0e55682b2492

    • SHA1

      280386782e0dfad5991a218e1601ec5ca7ebc67b

    • SHA256

      2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670

    • SHA512

      31a9b11b9ffeb1fa4c8b10827917c99caf501276c5f55456bd1b2249f67926ccc011327c92722e8c4f7360f39b6e0d02895f705bf21d49bc4c12d29a425d8ab0

    Score
    10/10
    persistenceupxbadrabbitransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks