fdc3f813aad6c05ec6707547d954508e023b6b05670815f60b2aba9ec089697f | Triage

Sharing

General

Target

fdc3f813aad6c05ec6707547d954508e023b6b05670815f60b2aba9ec089697f
Size

240KB
Sample

221128-gb2t9ahh92
MD5

06b4b16ce0ad5d1be4ab1c30a7785ba0
SHA1

830a92afc80440e39dd3259ec6546f21adf89149
SHA256

fdc3f813aad6c05ec6707547d954508e023b6b05670815f60b2aba9ec089697f
SHA512

9b3ffded21b31f740b004cb499ce6987ce576a26b651ffc6670c72723f2b54daeaafa50f01094a2c1aa5205eec054c8ed496a8de06a2177e79797674e998bd0e
SSDEEP

3072:bNMbouT5aJyrnRDDoYSQu7zy9BK1RsRQB4FZEuZDxZzK5ATxrHgbJm5ZQYLhPm:BMbouT5HrRv1ZBcHGF7DT38s5ZBLhe

Score

9^/10

persistence ransomware

Malware Config

Targets

- Target
  
  fdc3f813aad6c05ec6707547d954508e023b6b05670815f60b2aba9ec089697f
- Size
  
  240KB
- MD5
  
  06b4b16ce0ad5d1be4ab1c30a7785ba0
- SHA1
  
  830a92afc80440e39dd3259ec6546f21adf89149
- SHA256
  
  fdc3f813aad6c05ec6707547d954508e023b6b05670815f60b2aba9ec089697f
- SHA512
  
  9b3ffded21b31f740b004cb499ce6987ce576a26b651ffc6670c72723f2b54daeaafa50f01094a2c1aa5205eec054c8ed496a8de06a2177e79797674e998bd0e
- SSDEEP
  
  3072:bNMbouT5aJyrnRDDoYSQu7zy9BK1RsRQB4FZEuZDxZzK5ATxrHgbJm5ZQYLhPm:BMbouT5HrRv1ZBcHGF7DT38s5ZBLhe
Score

9^/10

persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Drops startup file
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceransomware

behavioral2