Overview

overview

10

Static

static

8

c04509c1b8...11.exe

windows7_x64

10

c04509c1b8...11.exe

windows10_x64

1

Resubmissions

30-11-2021 16:32

211130-t1xm2saff7 10

30-11-2021 16:12

211130-tnstbsfdhp 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c04509c1b80c129a7486119436c9ada5b0505358e97c1508b2cfb5c2a177ed11

  • Size

    808KB

  • Sample

    211130-t1xm2saff7

  • MD5

    7202c948aa5af1134efdfe978ec6ef60

  • SHA1

    5dbe3713b309e6ecc208e2a6c038aeb1762340d4

  • SHA256

    c04509c1b80c129a7486119436c9ada5b0505358e97c1508b2cfb5c2a177ed11

  • SHA512

    6bde3835669ee733090a3448246fb95fa0ff4cebc7b8e000dc9e13fa68aef0cb21cc778892d163a8757a486b1a69c44759a7e9a6ca4b52ab4db937a5806def1e

Score
10/10
hiveransomwarespywarestealerupx

Malware Config

Targets

    • Target

      c04509c1b80c129a7486119436c9ada5b0505358e97c1508b2cfb5c2a177ed11

    • Size

      808KB

    • MD5

      7202c948aa5af1134efdfe978ec6ef60

    • SHA1

      5dbe3713b309e6ecc208e2a6c038aeb1762340d4

    • SHA256

      c04509c1b80c129a7486119436c9ada5b0505358e97c1508b2cfb5c2a177ed11

    • SHA512

      6bde3835669ee733090a3448246fb95fa0ff4cebc7b8e000dc9e13fa68aef0cb21cc778892d163a8757a486b1a69c44759a7e9a6ca4b52ab4db937a5806def1e

    Score
    10/10
    hiveransomwarespywarestealer

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops file in Drivers directory

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks