General
-
Target
b909408a7f5be6fa466071bafc0949c092ee53a655a83cc28a6f633eb4d9d45f
-
Size
994KB
-
Sample
220306-fq4fysbgdk
-
MD5
c43c4e32d8f30c6c63aea0d6dc5c11cd
-
SHA1
93d1bc3f0b9e03a43bcf789928ac12ecdea24588
-
SHA256
b909408a7f5be6fa466071bafc0949c092ee53a655a83cc28a6f633eb4d9d45f
-
SHA512
95566d9f393e5bb9ab44834841e757eeb4c326ec454ce34e955e20b499d3ff8a5585fb91abb6ac1043fd76ad6942e447f9d36a353895a74654ce73bf74452d52
Malware Config
Targets
-
-
Target
b909408a7f5be6fa466071bafc0949c092ee53a655a83cc28a6f633eb4d9d45f
-
Size
994KB
-
MD5
c43c4e32d8f30c6c63aea0d6dc5c11cd
-
SHA1
93d1bc3f0b9e03a43bcf789928ac12ecdea24588
-
SHA256
b909408a7f5be6fa466071bafc0949c092ee53a655a83cc28a6f633eb4d9d45f
-
SHA512
95566d9f393e5bb9ab44834841e757eeb4c326ec454ce34e955e20b499d3ff8a5585fb91abb6ac1043fd76ad6942e447f9d36a353895a74654ce73bf74452d52
Score10/10-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Modifies Windows Firewall
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-