General
-
Target
398f2d4704aa884e676cf971b7cfaba82ce8b0d791b63b51c36bd76b4484cca7
-
Size
1.3MB
-
Sample
220305-x5mkesagcp
-
MD5
056a68f7c923ced5e13df36cd7ffba93
-
SHA1
a386d3650975bafd35aee69cd59b895780b0b70b
-
SHA256
398f2d4704aa884e676cf971b7cfaba82ce8b0d791b63b51c36bd76b4484cca7
-
SHA512
b218331bbdfc793a490a0b82d38300d1aeb829b355ec91c8a7a80f78772052d6a0dcd7a8bd65d9e85f28b4b010deb0537c9c6cc526381f9f8649fbdae8bb514b
Malware Config
Targets
-
-
Target
398f2d4704aa884e676cf971b7cfaba82ce8b0d791b63b51c36bd76b4484cca7
-
Size
1.3MB
-
MD5
056a68f7c923ced5e13df36cd7ffba93
-
SHA1
a386d3650975bafd35aee69cd59b895780b0b70b
-
SHA256
398f2d4704aa884e676cf971b7cfaba82ce8b0d791b63b51c36bd76b4484cca7
-
SHA512
b218331bbdfc793a490a0b82d38300d1aeb829b355ec91c8a7a80f78772052d6a0dcd7a8bd65d9e85f28b4b010deb0537c9c6cc526381f9f8649fbdae8bb514b
Score10/10-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-