9799297463.zip
- SHA256 d02e90d20c017aeed7641a978b2c99fb2bdaceaab0c387b332525dee3d8496ab
Password
infected
Behavioral task
behavioral1
Sample
21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe
Resource
win7-20230220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 9799297463.zip
- Size 3.2MB
- Sample230330-pnymcscf32
- SHA256 d02e90d20c017aeed7641a978b2c99fb2bdaceaab0c387b332525dee3d8496ab
- MD5 10577e33d4240905be88fabbcbb5a8f4
- SHA1 050fcee93af019a0d436d4e32653ee9d2152d941
- SHA512 1155ec2a5362185e11186c5d629aced2c3fa5f37fa561a22c5b561ea5d6afd013d2713e042e766be90485a6a7998b69bded193d64abbf5c236e4d9aa8f8f9e1c
- SSDEEP 98304:DBMVSycfkIQHWwTDnglCXkpMmz1eA5bmc:DB9y87Q2CDn8CUhEwv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Black Basta payload 1 IoCs
resource yara_rule static1/unpack001/21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda family_blackbasta - Blackbasta family
- Ech0raix family
- eCh0raix ransomware 1 IoCs
resource yara_rule static1/unpack001/21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda family_ech0raix
File Explorer
-
9799297463.zip.zip 3.2MB
-
21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe 7.0MB
21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda
- IMPHASH 23f9df8e3fa0bbe313771c0a01ac6eae
- SHA256 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda
- MD5 ed891e4fd173700fac93b3dda30517c9
- SHA1 e05e9cc2f28bcd17f5285a34db2894bad9ccd53a
- SHA512 58d3254bca944cb60450e3ac352a3674ca5a1dea1142112726349931cbed6428e5db03004480d218bf4c63ce6d9847e74dfe9f0da455c9587cf47c5a7089e7fc
- SSDEEP 98304:wkwtlijhe6cZyFAz5FNZiTfVFScxge3SO9o:wkilvxFNkxpx/19o
- MD5 SHA1 SHA512 SSDEEP
-
Black Basta payload
-
eCh0raix ransomware
Password
infected
Minor OS version
Major OS version
Entry point
321752
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wldap32
ord88
ord13
ord191
ord135
ord206
ord224
ord140
ord27
ord26
ord41
ord72
ord215
ord14
ord145
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
GetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
GetVolumeInformationW
GetTempPathW
GetVolumePathNamesForVolumeNameW
CloseHandle
GetLastError
DeviceIoControl
ReleaseMutex
CreateMutexW
OpenMutexW
SetEnvironmentVariableW
GetCurrentProcessId
GetTickCount
GetModuleFileNameW
LocalAlloc
LocalFree
FormatMessageW
CopyFileW
MoveFileW
FreeConsole
GetComputerNameExW
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
Sleep
GetSystemTimeAsFileTime
FormatMessageA
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
QueryPerformanceCounter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
RtlUnwind
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetFileAttributesW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
user32
SystemParametersInfoW
shell32
SHChangeNotify
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
VariantInit
SysFreeString
SysAllocStringLen
SysAllocString
advapi32
RegSetValueExW
RegCreateKeyExW
SetSecurityDescriptorDacl
SetFileSecurityW
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetEntriesInAclW
Name
.text
Size
524KB
Virtual Size
524KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
158KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ