Overview

overview

10

Static

static

20161205_3...bbf.js

windows7_x64

10

20161205_3...bbf.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20161205_3f1d7664595d2ff885b9fa3bf8a96bbf.js

  • Size

    13KB

  • Sample

    211117-nyj2aahdcq

  • MD5

    181a0ef665583fb02134e9effa90f86f

  • SHA1

    815bd5e80fb2ba833514548c70a5e35014a993b1

  • SHA256

    c4370948896e4b1d2fded7d0a85127f5c2e1564e41ecbc47c810ae76b1473ac4

  • SHA512

    650b1f77700ea60e0c8bfca25b364a35722a1f6b26ed2358d553adb0ae100ececffb11fa1af873ecf2318e3002e115fb2ce5d7b98f5e16c6428baae18e2d0a10

Score
10/10
lockylocky_osirisransomwaresuricata

Malware Config

Targets

    • Target

      20161205_3f1d7664595d2ff885b9fa3bf8a96bbf.js

    • Size

      13KB

    • MD5

      181a0ef665583fb02134e9effa90f86f

    • SHA1

      815bd5e80fb2ba833514548c70a5e35014a993b1

    • SHA256

      c4370948896e4b1d2fded7d0a85127f5c2e1564e41ecbc47c810ae76b1473ac4

    • SHA512

      650b1f77700ea60e0c8bfca25b364a35722a1f6b26ed2358d553adb0ae100ececffb11fa1af873ecf2318e3002e115fb2ce5d7b98f5e16c6428baae18e2d0a10

    Score
    10/10
    lockylocky_osirisransomwaresuricata

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Locky (Osiris variant)

      Variant of the Locky ransomware seen in the wild since early 2017.

      ransomwarelocky_osiris

    • suricata: ET MALWARE Nemucod JS Downloader Aug 01 2017

      suricata: ET MALWARE Nemucod JS Downloader Aug 01 2017

      suricata

    • Blocklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks