Overview

overview

10

Static

static

26dd7e5586...40.exe

windows7_x64

10

26dd7e5586...40.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26dd7e5586e14c19b2e691249222f761f49dbed6b4a418f5c01f324848047040

  • Size

    212KB

  • Sample

    220616-hvbmvagacp

  • MD5

    85181bc7f85b197b6128031a2781dd08

  • SHA1

    750160b2d1a83e743bb06584bad158b0bb4ef426

  • SHA256

    26dd7e5586e14c19b2e691249222f761f49dbed6b4a418f5c01f324848047040

  • SHA512

    ac51fd25bf4ff5f41ce503d65dbcd9c1f4b9a078393bacb3a619b030e1014ec73ff75ec1cd456a6d28a4f09307c01cd744621edc5aa7d4f6c9f1cee4d2acd741

Score
10/10
lockypersistenceransomwaresuricata

Malware Config

Targets

    • Target

      26dd7e5586e14c19b2e691249222f761f49dbed6b4a418f5c01f324848047040

    • Size

      212KB

    • MD5

      85181bc7f85b197b6128031a2781dd08

    • SHA1

      750160b2d1a83e743bb06584bad158b0bb4ef426

    • SHA256

      26dd7e5586e14c19b2e691249222f761f49dbed6b4a418f5c01f324848047040

    • SHA512

      ac51fd25bf4ff5f41ce503d65dbcd9c1f4b9a078393bacb3a619b030e1014ec73ff75ec1cd456a6d28a4f09307c01cd744621edc5aa7d4f6c9f1cee4d2acd741

    Score
    10/10
    lockyransomwaresuricatapersistence

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • suricata: ET MALWARE Locky CnC Checkin HTTP Pattern

      suricata: ET MALWARE Locky CnC Checkin HTTP Pattern

      suricata

    • suricata: ET MALWARE Locky CnC checkin Nov 21

      suricata: ET MALWARE Locky CnC checkin Nov 21

      suricata

    • suricata: ET MALWARE Locky CnC checkin Nov 21 M2

      suricata: ET MALWARE Locky CnC checkin Nov 21 M2

      suricata

    • suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses

      suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses

      suricata

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks