General
-
Target
HEUR-Trojan-Ransom.Win32.Generic-6b167b5db9479f23463dcad1190e9f319b4747dab56e64ab142020fbbbe1b1c3.exe
-
Size
62KB
-
Sample
220925-e6hnradcd3
-
MD5
093fdf024696c4bd632323169c51f487
-
SHA1
7a79285f8ea5e3b6cef88fc61394c305458b3dac
-
SHA256
6b167b5db9479f23463dcad1190e9f319b4747dab56e64ab142020fbbbe1b1c3
-
SHA512
122a9e1dc6e6a774857372f7aa52c032cf3ff901eb93fc63ec8f15a95fa339c9fc654a4b5165a5d29f053d0eff889a07876d019d20a4cfa2ba2c374b6c96a545
-
SSDEEP
768:VDKsMqCXfVcW3fM9Zk5ANIU3LWLDwUzc80gmq3oP/oDj:9KsePM9Zk5APyr/0O8/oX
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan-Ransom.Win32.Generic-6b167b5db9479f23463dcad1190e9f319b4747dab56e64ab142020fbbbe1b1c3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
HEUR-Trojan-Ransom.Win32.Generic-6b167b5db9479f23463dcad1190e9f319b4747dab56e64ab142020fbbbe1b1c3.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
HEUR-Trojan-Ransom.Win32.Generic-6b167b5db9479f23463dcad1190e9f319b4747dab56e64ab142020fbbbe1b1c3.exe
-
Size
62KB
-
MD5
093fdf024696c4bd632323169c51f487
-
SHA1
7a79285f8ea5e3b6cef88fc61394c305458b3dac
-
SHA256
6b167b5db9479f23463dcad1190e9f319b4747dab56e64ab142020fbbbe1b1c3
-
SHA512
122a9e1dc6e6a774857372f7aa52c032cf3ff901eb93fc63ec8f15a95fa339c9fc654a4b5165a5d29f053d0eff889a07876d019d20a4cfa2ba2c374b6c96a545
-
SSDEEP
768:VDKsMqCXfVcW3fM9Zk5ANIU3LWLDwUzc80gmq3oP/oDj:9KsePM9Zk5APyr/0O8/oX
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-