Overview

overview

10

Static

static

4d5120b499...le.exe

windows7_x64

10

4d5120b499...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d5120b49993002b1a1a77298b0e9e486a0aa75eb9fb14fe3c6682a9870203f6.sample

  • Size

    142KB

  • Sample

    210726-3gt8kcv9fe

  • MD5

    9dcb4b2e20be4c6d1f4bf4c2bf042bf2

  • SHA1

    f330758e727a129a4a9e8e031076c38b98efc2a6

  • SHA256

    4d5120b49993002b1a1a77298b0e9e486a0aa75eb9fb14fe3c6682a9870203f6

  • SHA512

    67233aa8925420e8024b42ce5e2cbff9266ed8d539496a8976c5dfa284b457ccd93882ee4294488110f3099030d27afd85cf2c85f49d6b8bb81693bb8704ca16

Score
10/10
lockylocky_osirisransomwaresuricata

Malware Config

Targets

    • Target

      4d5120b49993002b1a1a77298b0e9e486a0aa75eb9fb14fe3c6682a9870203f6.sample

    • Size

      142KB

    • MD5

      9dcb4b2e20be4c6d1f4bf4c2bf042bf2

    • SHA1

      f330758e727a129a4a9e8e031076c38b98efc2a6

    • SHA256

      4d5120b49993002b1a1a77298b0e9e486a0aa75eb9fb14fe3c6682a9870203f6

    • SHA512

      67233aa8925420e8024b42ce5e2cbff9266ed8d539496a8976c5dfa284b457ccd93882ee4294488110f3099030d27afd85cf2c85f49d6b8bb81693bb8704ca16

    Score
    10/10
    lockylocky_osirisransomwaresuricata

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Locky (Osiris variant)

      Variant of the Locky ransomware seen in the wild since early 2017.

      ransomwarelocky_osiris

    • suricata: ET MALWARE Locky CnC Checkin Dec 5 M1

      suricata

    • suricata: ET MALWARE Locky CnC Checkin HTTP Pattern

      suricata

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks