Overview

overview

10

Static

static

8dff91cfab...cc.exe

windows7_x64

10

8dff91cfab...cc.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc

  • Size

    994KB

  • Sample

    220212-artp9afefm

  • MD5

    21a69dfb179a807024a0b8d5838c945c

  • SHA1

    78e680ace5f3c0c226a12210f093f0c5b0e85542

  • SHA256

    8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc

  • SHA512

    55567a6859f33f2d18a59136cd87458a9219eb9ef9585a305e08ea8f42508460b36b95ef3b5474d5e6eddd64e691cd45fbd9ccb755825a1e336815fe45a04c0a

Score
10/10
ouroborosevasionransomware

Malware Config

Targets

    • Target

      8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc

    • Size

      994KB

    • MD5

      21a69dfb179a807024a0b8d5838c945c

    • SHA1

      78e680ace5f3c0c226a12210f093f0c5b0e85542

    • SHA256

      8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc

    • SHA512

      55567a6859f33f2d18a59136cd87458a9219eb9ef9585a305e08ea8f42508460b36b95ef3b5474d5e6eddd64e691cd45fbd9ccb755825a1e336815fe45a04c0a

    Score
    10/10
    ouroborosevasionransomware

    • Ouroboros/Zeropadypt

      Ransomware family based on open-source CryptoWire.

      ransomwareouroboros

    • Modifies Windows Firewall

      evasion

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks