Overview

overview

10

Static

static

83893840f7...fb.exe

windows7_x64

10

83893840f7...fb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    83893840f778288f348ac8c6ed680df82ef88c60320b1b6f8a0acb7d2e5c17fb

  • Size

    309KB

  • Sample

    220628-s97c6sccd8

  • MD5

    a1f0ce5f942b2f8c51e1e30d85f61f12

  • SHA1

    eb280d1cb99e43561dd259c34d246baaf486d8c9

  • SHA256

    83893840f778288f348ac8c6ed680df82ef88c60320b1b6f8a0acb7d2e5c17fb

  • SHA512

    28409b68728458b8788fccee0734933be98590b0c0cb4842e0a825f7bb9790de5fd213163b82a1963130fc8bb1f400be07a9b84d3ef109722bb7ce6c07e0122c

Score
10/10
lockyransomwaresuricata

Malware Config

Targets

    • Target

      83893840f778288f348ac8c6ed680df82ef88c60320b1b6f8a0acb7d2e5c17fb

    • Size

      309KB

    • MD5

      a1f0ce5f942b2f8c51e1e30d85f61f12

    • SHA1

      eb280d1cb99e43561dd259c34d246baaf486d8c9

    • SHA256

      83893840f778288f348ac8c6ed680df82ef88c60320b1b6f8a0acb7d2e5c17fb

    • SHA512

      28409b68728458b8788fccee0734933be98590b0c0cb4842e0a825f7bb9790de5fd213163b82a1963130fc8bb1f400be07a9b84d3ef109722bb7ce6c07e0122c

    Score
    10/10
    lockyransomwaresuricata

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • suricata: ET MALWARE Ransomware Locky CnC Beacon

      suricata: ET MALWARE Ransomware Locky CnC Beacon

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks