Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Agent.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Trojan-Ransom.Win32.Agent.exe
Resource
win10v2004-20220901-en
General
-
Target
Trojan-Ransom.Win32.Agent.hsf-4cf7ddc4ea9c4e6649d08ebc11179d95dedef5332d7987d7467b08a70919f402
-
Size
279KB
-
MD5
555ac0b62654c61ba003679ec579d6cd
-
SHA1
a4954609a6abd8bcc2c474f8d5cf0e60580e18b7
-
SHA256
4cf7ddc4ea9c4e6649d08ebc11179d95dedef5332d7987d7467b08a70919f402
-
SHA512
aad0fcb3f35acd7cc0cf76e53af504818cce96e2e7f3bce4da08765d8b5070570589749091d1b7f6b8fec9529d38341b71621ac06a5650db330f080cff1a0781
-
SSDEEP
6144:CGahaRFe4Bk/K/jNrart0Nz1rH/MWQDTi86OuyTtRN9vVti:CGiavOMxiW901i85uyxR
Malware Config
Signatures
Files
-
Trojan-Ransom.Win32.Agent.hsf-4cf7ddc4ea9c4e6649d08ebc11179d95dedef5332d7987d7467b08a70919f402.exe windows x86
323896a286de83a6eabe8e34f193ac21
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
CreateDirectoryA
SetVolumeLabelA
ResetEvent
IsBadWritePtr
GetVersion
GetSystemTime
SetEvent
FindClose
CreateSemaphoreW
RemoveDirectoryA
GetFileType
FindClose
ReleaseMutex
ExitThread
CreatePipe
GetDriveTypeW
RemoveDirectoryA
WriteFile
HeapFree
SetStdHandle
FindAtomA
GetModuleHandleA
WriteConsoleA
VirtualProtectEx
uxtheme
GetWindowTheme
GetThemeRect
CloseThemeData
GetThemeColor
GetThemeTextExtent
GetThemeTextMetrics
IsThemeActive
CloseThemeData
OpenThemeData
GetThemeSysSize
DrawThemeBackground
SetWindowTheme
DrawThemeEdge
pstorsvc
Start
Start
Start
Start
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 10B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 270KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ