dmalocker | 11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152

General

Target

EliStarA.exe
Size

1.7MB
Sample

230218-a5r4kshg5y
MD5

6b8dcb09a6f8e836b5dcc600d11c6223
SHA1

b0a1582b9e9871064afae5cb6b1d369599506763
SHA256

11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152
SHA512

feb8bd04778b29efc9b0128dbfd9562368eb825a560dc610abed6a73de1dc7bd33e5e198b439b36828d0a66d4657e354d4a65646141ad3425bed6fd74cb7fcae
SSDEEP

49152:lJCDpfmhr2qIhBCwb8lIgwylCJHXv5y7lE8X:6HB/b8KgZA5E

Score

10^/10

Malware Config

Targets

- Target
  
  EliStarA.exe
- Size
  
  1.7MB
- MD5
  
  6b8dcb09a6f8e836b5dcc600d11c6223
- SHA1
  
  b0a1582b9e9871064afae5cb6b1d369599506763
- SHA256
  
  11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152
- SHA512
  
  feb8bd04778b29efc9b0128dbfd9562368eb825a560dc610abed6a73de1dc7bd33e5e198b439b36828d0a66d4657e354d4a65646141ad3425bed6fd74cb7fcae
- SSDEEP
  
  49152:lJCDpfmhr2qIhBCwb8lIgwylCJHXv5y7lE8X:6HB/b8KgZA5E
Score

10^/10

dmalocker hawkeye locky locky_osiris modiloader wannacry discovery keylogger persistence ransomware spyware stealer trojan upx worm
- DMA Locker
  Ransomware family with some advanced features, like encryption of unmapped network shares.
  ransomware dmalocker
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Locky
  Ransomware strain released in 2016, with advanced features like anti-analysis.
  ransomware locky
- Locky (Osiris variant)
  Variant of the Locky ransomware seen in the wild since early 2017.
  ransomware locky_osiris
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies system executable filetype association
  persistence
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Adds policy Run key to start application
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Drops startup file
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2