Overview

overview

10

Static

static

10

8f50fbedc4...73.exe

windows7_x64

10

8f50fbedc4...73.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f50fbedc43a58fef6fe276a60eaf8a9539a8573.rl.zip

  • Size

    2.4MB

  • Sample

    220708-h3vexseggn

  • MD5

    a88255a14ce0a6863d1b256e08aa97e9

  • SHA1

    3ab9b8860b431ca290fde495ed9508fb84ba4145

  • SHA256

    5513b157beb22e67e20412c040964d626ca1f1938cb92a8440b3e8e016409941

  • SHA512

    fa0f4a15bf7a64c65fb9fa8a667335985a696f375700479e744982b0167d6a09b20d8b8767a680365c713e2bd859d616cbfb8c736be9b9e140ec4e31e2a813ca

Score
10/10
snatchransomwarespywarestealerupx

Malware Config

Targets

    • Target

      8f50fbedc43a58fef6fe276a60eaf8a9539a8573.rl

    • Size

      4.8MB

    • MD5

      3b0cbbf271ff15faa0c5424de4a974f9

    • SHA1

      8f50fbedc43a58fef6fe276a60eaf8a9539a8573

    • SHA256

      efc9c817a126690f3d29d2167debeb17b24d2aa677b9fc069e5aed95f5b7400b

    • SHA512

      5ed6b75d2b4f62a20830c03ee9208c683d6ec158677133d77671bad6cc9cbe12b0cc9cc8903b99fb3a7ba293e5f2986dfb6334e6d88d6c9b1af77da56cb75ae0

    Score
    10/10
    snatchransomwarespywarestealerupx

    • Detecting the common Go functions and variables names used by Snatch ransomware

    • Snatch Ransomware

      Ransomware family generally distributed through RDP bruteforce attacks.

      ransomwaresnatch

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Generic Ransomware Note

      Ransomware often writes a note containing information on how to pay the ransom.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks