General
-
Target
fc925828184414ad44912fc6ca35af25aa6bbcff505026b1fc208b4064bdd388
-
Size
519KB
-
Sample
221115-w5m1hsfb94
-
MD5
d2e5de5fde2df40aa2515e9d13b0735c
-
SHA1
f6ebd38d354746482db21fb989cb22c0a764f098
-
SHA256
fc925828184414ad44912fc6ca35af25aa6bbcff505026b1fc208b4064bdd388
-
SHA512
9b18cd6ad5f37402be935e85df5c1e4032e16e29374de26c9aa6cfb41fc05077e16cfd89b49fe016bc34c61bf9132a44b1efb7a70c4c342278cc24733ac3e0c0
-
SSDEEP
12288:ggA009BmT3iiOjSXlBCq/3zn98aLAW1jI6UDymBdxgwcn6ilhbOD4:YPbcOjSieAWIg9o4
Malware Config
Targets
-
-
Target
fc925828184414ad44912fc6ca35af25aa6bbcff505026b1fc208b4064bdd388
-
Size
519KB
-
MD5
d2e5de5fde2df40aa2515e9d13b0735c
-
SHA1
f6ebd38d354746482db21fb989cb22c0a764f098
-
SHA256
fc925828184414ad44912fc6ca35af25aa6bbcff505026b1fc208b4064bdd388
-
SHA512
9b18cd6ad5f37402be935e85df5c1e4032e16e29374de26c9aa6cfb41fc05077e16cfd89b49fe016bc34c61bf9132a44b1efb7a70c4c342278cc24733ac3e0c0
-
SSDEEP
12288:ggA009BmT3iiOjSXlBCq/3zn98aLAW1jI6UDymBdxgwcn6ilhbOD4:YPbcOjSieAWIg9o4
Score10/10-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-