nefilim | ea6ced3730495e2231c1a755fcc1aefac7622ac4bd5e269b2a5996572acb42f9

General

Target
ea6ced3730495e2231c1a755fcc1aefac7622ac4bd5e269b2a5996572acb42f9
Size 79KB
Sample220131-3ts6qaeca5
SHA256 ea6ced3730495e2231c1a755fcc1aefac7622ac4bd5e269b2a5996572acb42f9
MD5 780a4c89ba8e4af56e557b7faf73b42b
SHA1 d255716d5e2a6ce57ec07f13de38d2000dd3bb8d
SHA512 37b66f2ba70cf1dd785fe21f49627e208c2c3d1f92bfc5b39882099109fbcb6822366d4a876062a8b66c0b4a9b9098333fc3b21792786be1f3ee2346a6e82800
SSDEEP 768:PXKTJbrfwy8pnq7y2YzxYYP1d5ptDxyvhg6zkkhvkxEDZHKnv04Z4lvH+M+vTxQ:P0J3z8pnqIteZkhvslvUotY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx nefilim

Malware Config

Signatures

Nefilim Ransomware Executable 1 IoCs

File contains patterns typical of Nefilim samples.

resource	yara_rule
sample	nefilim_ransomware

Nefilim family
nefilim

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

ea6ced3730495e2231c1a755fcc1aefac7622ac4bd5e269b2a5996572acb42f9

.exe 79KB

ea6ced3730495e2231c1a755fcc1aefac7622ac4bd5e269b2a5996572acb42f9

IMPHASH 5d263e2fae768bf9e065c1809198cfd5
SHA256 ea6ced3730495e2231c1a755fcc1aefac7622ac4bd5e269b2a5996572acb42f9
MD5 780a4c89ba8e4af56e557b7faf73b42b
SHA1 d255716d5e2a6ce57ec07f13de38d2000dd3bb8d
SHA512 37b66f2ba70cf1dd785fe21f49627e208c2c3d1f92bfc5b39882099109fbcb6822366d4a876062a8b66c0b4a9b9098333fc3b21792786be1f3ee2346a6e82800
SSDEEP 768:PXKTJbrfwy8pnq7y2YzxYYP1d5ptDxyvhg6zkkhvkxEDZHKnv04Z4lvH+M+vTxQ:P0J3z8pnqIteZkhvslvUotY
MD5 SHA1 SHA512 SSDEEP

windows x86

Nefilim Ransomware Executable

File contains patterns typical of Nefilim samples.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

16196

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

CryptDecrypt CryptCreateHash CryptDeriveKey CryptDestroyKey CryptEncrypt CryptImportKey CryptAcquireContextA CryptReleaseContext CryptHashData

kernel32

GetTickCount GetProcessHeap WriteFile Sleep ReadFile CreateFileW GetFileSizeEx GetStdHandle GetLastError SetLastError GetProcAddress MoveFileW GetLogicalDrives LoadLibraryA lstrcmpiW FindNextFileW CloseHandle CreateThread ExitProcess GetModuleFileNameW WideCharToMultiByte ExitThread MultiByteToWideChar CreateMutexA WaitForSingleObject HeapFree SetFilePointerEx GetCurrentProcess HeapAlloc GetDriveTypeW lstrlenA FindFirstFileW FindClose GetSystemDefaultLangID GetStringTypeW LCMapStringW IsValidCodePage GetSystemTimeAsFileTime EncodePointer DecodePointer GetCommandLineA HeapSetInformation RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize GetModuleHandleW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId LeaveCriticalSection EnterCriticalSection RtlUnwind HeapReAlloc LoadLibraryW GetCPInfo GetACP GetOEMCP

shell32

ShellExecuteW

shlwapi

PathFindExtensionW PathIsDirectoryW

Sharing