Extracted

Extracted

• • Target

    6b97553c9dfeedcc50b19dacacf8662b68bd3f65b3fa6bed2e5cb9ae778eabd8.exe

  • Size

    215KB

  • MD5

    f41306eb937e2dc08f196a61e0f6c34e

  • SHA1

    e3e6af9e1be25f86a892018f35876b48b31dcc6c

  • SHA256

    6b97553c9dfeedcc50b19dacacf8662b68bd3f65b3fa6bed2e5cb9ae778eabd8

  • SHA512

    5e28f987097ca961d6911c671dd9a0868ced5e1d7a434930d1eec242d5044978877453f3e667dfcd195e12ea381ebc21db841d99639de273a4e653b514aecc3a

  • SSDEEP

    6144:WyJE1yd7WiJmcyfpHaShzh04DQFu/U3buRKlemZ9DnGAeIS+giiK+:WU/d7WnvtLhza4DQFu/U3buRKlemZ9De

  Score

  10^/10

  zeppelinpersistenceransomware

  • Detects Zeppelin payload

  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Executes dropped EXE

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2