Overview

overview

8

Static

static

8

1c180f8f48...8d.exe

windows7-x64

8

1c180f8f48...8d.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    1c180f8f480b87a62ffdfbd4dc32ac664e6913d03b112fd3df780bb9f821a78d

  • Size

    424KB

  • Sample

    221226-m25lqacg83

  • MD5

    bf6f7ef2802705565d33ad4c9225acda

  • SHA1

    d9a921d6e4f0d206e646700513eda143db239635

  • SHA256

    1c180f8f480b87a62ffdfbd4dc32ac664e6913d03b112fd3df780bb9f821a78d

  • SHA512

    4151218298bf9111465b4b5d140f85abc01872cad4b54dbdefb2e061cbc4f09b6c03f4c6fe202f6034c2e41b70ee754be4bf5cefb15b902ac0b1a966cb916ec3

  • SSDEEP

    6144:JHEmrnWIHf5Kt4m6bkyotM4dxtsXgrNfl0EUl0srjnLoL:JHEmjH/5KtEbkRtM0jflnUWILoL

Score
8/10
persistenceransomwareupx

Malware Config

Targets

    • Target

      1c180f8f480b87a62ffdfbd4dc32ac664e6913d03b112fd3df780bb9f821a78d

    • Size

      424KB

    • MD5

      bf6f7ef2802705565d33ad4c9225acda

    • SHA1

      d9a921d6e4f0d206e646700513eda143db239635

    • SHA256

      1c180f8f480b87a62ffdfbd4dc32ac664e6913d03b112fd3df780bb9f821a78d

    • SHA512

      4151218298bf9111465b4b5d140f85abc01872cad4b54dbdefb2e061cbc4f09b6c03f4c6fe202f6034c2e41b70ee754be4bf5cefb15b902ac0b1a966cb916ec3

    • SSDEEP

      6144:JHEmrnWIHf5Kt4m6bkyotM4dxtsXgrNfl0EUl0srjnLoL:JHEmjH/5KtEbkRtM0jflnUWILoL

    Score
    8/10
    persistenceransomwareupx

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks