General
-
Target
HEUR-Trojan-Ransom.Win32.Generic-5de3ebedb1db4ff64a70a247d29d2826dfa71eca355a66a21e83011a103e523a.exe
-
Size
61KB
-
Sample
220925-e6hnradcd2
-
MD5
0341a286ceb5a120b6c4d6eb7f3e04f2
-
SHA1
7e2773b8bcaaa0be5f9f11337e559b25408edd37
-
SHA256
5de3ebedb1db4ff64a70a247d29d2826dfa71eca355a66a21e83011a103e523a
-
SHA512
f7551f229a963ba729936cc7b192372e41a807af9e81b906a0eb1a9e0e4a08e2eca779a52582d1c4b3f09edfdb9a827d6e4558c23501b468c9265ef494b6d0c8
-
SSDEEP
768:3KsMqCXfVcW1OM9ZQSANIUTdkLDwUzc80gmq3oP/oDW:3Kse0M9ZQSAP6r/0O8/oi
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan-Ransom.Win32.Generic-5de3ebedb1db4ff64a70a247d29d2826dfa71eca355a66a21e83011a103e523a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan-Ransom.Win32.Generic-5de3ebedb1db4ff64a70a247d29d2826dfa71eca355a66a21e83011a103e523a.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
HEUR-Trojan-Ransom.Win32.Generic-5de3ebedb1db4ff64a70a247d29d2826dfa71eca355a66a21e83011a103e523a.exe
-
Size
61KB
-
MD5
0341a286ceb5a120b6c4d6eb7f3e04f2
-
SHA1
7e2773b8bcaaa0be5f9f11337e559b25408edd37
-
SHA256
5de3ebedb1db4ff64a70a247d29d2826dfa71eca355a66a21e83011a103e523a
-
SHA512
f7551f229a963ba729936cc7b192372e41a807af9e81b906a0eb1a9e0e4a08e2eca779a52582d1c4b3f09edfdb9a827d6e4558c23501b468c9265ef494b6d0c8
-
SSDEEP
768:3KsMqCXfVcW1OM9ZQSANIUTdkLDwUzc80gmq3oP/oDW:3Kse0M9ZQSAP6r/0O8/oi
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-