General
-
Target
3b7c7a6b8bcde4a4f5ee586fea46d1bb77da42caf2d5d0d48767615e2ddef451
-
Size
1.3MB
-
Sample
220306-a785wahfg3
-
MD5
fd051c28d517d4a4cfaf09fe5c0f6b3e
-
SHA1
e960aee473dc56902276e1d91392fb04597f58df
-
SHA256
3b7c7a6b8bcde4a4f5ee586fea46d1bb77da42caf2d5d0d48767615e2ddef451
-
SHA512
06c0edd9e6cd88f71b4c5547b961b66b5b22ca78f45489f6f9f0c9a3caba1228f09ff7a58222fe14fc78ddf58f1a6ef4fa5a2cbf63cb9ec8c103073844b66397
Malware Config
Targets
-
-
Target
3b7c7a6b8bcde4a4f5ee586fea46d1bb77da42caf2d5d0d48767615e2ddef451
-
Size
1.3MB
-
MD5
fd051c28d517d4a4cfaf09fe5c0f6b3e
-
SHA1
e960aee473dc56902276e1d91392fb04597f58df
-
SHA256
3b7c7a6b8bcde4a4f5ee586fea46d1bb77da42caf2d5d0d48767615e2ddef451
-
SHA512
06c0edd9e6cd88f71b4c5547b961b66b5b22ca78f45489f6f9f0c9a3caba1228f09ff7a58222fe14fc78ddf58f1a6ef4fa5a2cbf63cb9ec8c103073844b66397
Score10/10-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-