Overview

overview

10

Static

static

3d65377193...ca.exe

windows7_x64

10

3d65377193...ca.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca

  • Size

    606KB

  • Sample

    220703-drkdcsdbej

  • MD5

    91a61e3be9cc7251972f6ee8d4836cb4

  • SHA1

    f78c091a623c605e74511dd80d1a48376c2c4145

  • SHA256

    3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca

  • SHA512

    aa773715d5333b7fc20517e8449f5fd4d54781d6d175ce7d0fbaea9b862ac6aeca8835254a37c8edccaf584d3b56d15a79d20fe296f885d2c1c300cd5487da60

Score
10/10
locky_lukituspersistenceransomwaresuricata

Malware Config

Targets

    • Target

      3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca

    • Size

      606KB

    • MD5

      91a61e3be9cc7251972f6ee8d4836cb4

    • SHA1

      f78c091a623c605e74511dd80d1a48376c2c4145

    • SHA256

      3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca

    • SHA512

      aa773715d5333b7fc20517e8449f5fd4d54781d6d175ce7d0fbaea9b862ac6aeca8835254a37c8edccaf584d3b56d15a79d20fe296f885d2c1c300cd5487da60

    Score
    10/10
    suricatalocky_lukituspersistenceransomware

    • Locky (Lukitus variant)

      Variant of the Locky ransomware seen in the wild since late 2017.

      ransomwarelocky_lukitus

    • suricata: ET MALWARE Locky CnC Checkin

      suricata: ET MALWARE Locky CnC Checkin

      suricata

    • suricata: ET MALWARE Locky CnC Checkin HTTP Pattern

      suricata: ET MALWARE Locky CnC Checkin HTTP Pattern

      suricata

    • suricata: ET MALWARE Locky CnC checkin Nov 21

      suricata: ET MALWARE Locky CnC checkin Nov 21

      suricata

    • suricata: ET MALWARE Locky CnC checkin Nov 21 M2

      suricata: ET MALWARE Locky CnC checkin Nov 21 M2

      suricata

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks