clop | 343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335.exe
Size 1.0MB
Sample230403-t6v2eafh74
SHA256 343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335
MD5 1e98a8d79ed7afbd77f6536dd7b4398f
SHA1 a074790705ecbede2e67cced4bcb62d833d828a5
SHA512 8bebdba0fdabfcff0b26dafc3b1a71ec50ba0e551bb8a3a82f91c91a1cdc09b6dfe87373c7966c01777265143a32d34bb760e9d4d9e968e3820f5370d95c99f5
SSDEEP 24576:xnuZd8go15167wsK3IPDvN1vDgvRE2qQWhZyWsshlrN36Fl09YSO/k:5kd8goP1CwsSIjTvDg5E2qBhfssTrN3L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

clop

Malware Config

Signatures

Clop family
clop

Detects Clop payload 1 IoCs

resource	yara_rule
sample	family_clop

File Explorer

343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335.exe

.exe 1.0MB

343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335.exe

IMPHASH abce2ca0bead1aaef1e5e2c4297d86bd
SHA256 343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335
MD5 1e98a8d79ed7afbd77f6536dd7b4398f
SHA1 a074790705ecbede2e67cced4bcb62d833d828a5
SHA512 8bebdba0fdabfcff0b26dafc3b1a71ec50ba0e551bb8a3a82f91c91a1cdc09b6dfe87373c7966c01777265143a32d34bb760e9d4d9e968e3820f5370d95c99f5
SSDEEP 24576:xnuZd8go15167wsK3IPDvN1vDgvRE2qQWhZyWsshlrN36Fl09YSO/k:5kd8goP1CwsSIjTvDg5E2qBhfssTrN3L
MD5 SHA1 SHA512 SSDEEP

windows x86

Detects Clop payload

Digest

df:3b:95:9f:cd:9e:9f:71:39:c9:65:67:f2:8a:3a:12:3c:d2:9f:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=VANTUN SRL,O=VANTUN SRL,ST=Dolj,C=RO

Serial Number

59:f5:29:32:de:5d:0e:49:67:b7:16:96:d4:ac:7e:97

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2022 - Jan 25, 2023

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

4695

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EraseTape GetSystemDefaultLCID CreateNamedPipeA HeapFree SetPriorityClass FindFirstFileNameW GetCommandLineW EnumCalendarInfoExEx IsDBCSLeadByteEx GetCurrentProcess GetConsoleOutputCP lstrlenW GetThreadErrorMode EnumResourceTypesW CreateFileMappingNumaW GetFileBandwidthReservation GetSystemDefaultUILanguage GetShortPathNameW TerminateProcess GetUserDefaultLangID GetModuleFileNameW GetSystemTimes GetConsoleCP GetThreadLocale GlobalUnWire GetCompressedFileSizeTransactedW DeleteFileTransactedA LocalHandle GetProcessId EnumResourceNamesA GetUserDefaultUILanguage FindNextFileA DeleteAtom Wow64GetThreadContext GetQueuedCompletionStatus GetFullPathNameA GetCompressedFileSizeW FlushProcessWriteBuffers PeekNamedPipe GetLargePageMinimum lstrlenA CreateMutexA LocalAlloc GetFileAttributesW GetCurrentThreadId GetPrivateProfileSectionNamesW UnregisterApplicationRecoveryCallback IsSystemResumeAutomatic GetCurrentDirectoryA GlobalDeleteAtom QueryMemoryResourceNotification OpenSemaphoreA GetAtomNameW lstrcatA GetStringScripts GetSystemDefaultLangID GetACP OpenProcess GetVersion _lopen GetCommandLineA CreateToolhelp32Snapshot CreateEventW QueryActCtxW Sleep EnumUILanguagesA GlobalAddAtomA GetTickCount64 GetLargestConsoleWindowSize GetFileAttributesA TzSpecificLocalTimeToSystemTime ZombifyActCtx Process32NextW GetMaximumProcessorGroupCount ConvertDefaultLocale FlushViewOfFile GetThreadUILanguage GetUserDefaultLCID SetEvent DefineDosDeviceA GetDiskFreeSpaceExW GetCurrentThread TerminateThread GetActiveProcessorGroupCount FindCloseChangeNotification GetProfileIntA LoadLibraryA TlsAlloc GetSystemDEPPolicy Process32FirstW HeapReAlloc AddConsoleAliasA CreateThreadpoolCleanupGroup CompareStringEx GetOEMCP LoadLibraryW GetThreadIOPendingFlag HeapAlloc CloseHandle GetDefaultCommConfigW SwitchToThread GetNamedPipeServerProcessId MoveFileWithProgressA FindNextFileNameW EnumSystemLanguageGroupsA IsThreadAFiber GetCurrentProcessorNumber ReadDirectoryChangesW GetSystemWow64DirectoryA GetErrorMode VirtualLock FindAtomA UnregisterApplicationRestart SetFileApisToOEM ReplaceFileW _lread WTSGetActiveConsoleSessionId NeedCurrentDirectoryForExePathA ExitProcess FindAtomW GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW FreeLibrary CreateSemaphoreW CreateSymbolicLinkW GetConsoleWindow GetLongPathNameTransactedW DeleteBoundaryDescriptor OpenFileMappingA lstrcmpiA TlsGetValue BeginUpdateResourceW ConvertFiberToThread SetFileApisToANSI MoveFileTransactedA VirtualFreeEx GetTempFileNameA lstrcmpiW GetPrivateProfileStringA GetEnvironmentStringsW WaitNamedPipeW lstrcmpW EnumDateFormatsW LocalUnlock GetConsoleAliasExesLengthA GetDriveTypeW InterlockedPopEntrySList IsDebuggerPresent CreateTimerQueue IsBadStringPtrW SizeofResource LockResource LoadResource FindResourceW DecodePointer WriteConsoleW SetFilePointerEx ReadConsoleW SetEndOfFile GetConsoleMode FlushFileBuffers HeapSize GetStringTypeW SetStdHandle LCMapStringW FreeEnvironmentStringsW GetCPInfo IsValidCodePage FindFirstFileExW GetFileType GetModuleHandleExW WideCharToMultiByte GetPrivateProfileSectionNamesA WriteProfileStringW GetLogicalDrives AddVectoredContinueHandler GetConsoleAliasExesLengthW InitializeSRWLock AreFileApisANSI GlobalUnlock GetTickCount MapViewOfFile CreateFileMappingW lstrcpyW GlobalLock FreeConsole CreateThread GlobalFree lstrcpyA GlobalAlloc lstrcatW GetLastError SetFileAttributesW ExitThread UnmapViewOfFile CreateFileW WaitForSingleObject FindClose SetFilePointer SetErrorMode VirtualAlloc WriteFile FindNextFileW MultiByteToWideChar GetStdHandle LoadLibraryExW GetProcAddress TlsFree TlsSetValue InitializeCriticalSectionAndSpinCount DeleteCriticalSection VirtualFree FindFirstFileW GetCurrencyFormatW ReadFile LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwind GetStartupInfoW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime RaiseException

user32

GetNextDlgGroupItem PtInRect InvalidateRect ReleaseDC CharUpperW wsprintfW GetDesktopWindow CharNextA IsCharLowerW DefWindowProcW GetFocus IsWindowVisible GetClipboardViewer DeleteMenu CreatePopupMenu DrawIcon DestroyCursor LoadStringW GetMenuCheckMarkDimensions CloseClipboard GetForegroundWindow EnumClipboardFormats DestroyMenu IntersectRect GetMenuStringW GetUpdateRect GetTabbedTextExtentW IsClipboardFormatAvailable CharUpperBuffW GetCaretBlinkTime HiliteMenuItem

gdi32

FrameRgn CreateFontW ExtFloodFill Polyline GetDIBits CreatePolyPolygonRgn PolyPolygon SetBkColor Ellipse GetSystemPaletteUse InvertRgn FillRgn GetCharWidthW Pie

advapi32

RegCreateKeyExW GetTokenInformation LookupAccountSidW RegDeleteTreeA RegDisablePredefinedCacheEx RevertToSelf CryptAcquireContextW SetServiceStatus CryptEncrypt RegisterServiceCtrlHandlerW OpenProcessToken CreateProcessAsUserW StartServiceCtrlDispatcherW RegRestoreKeyW DuplicateTokenEx

shell32

SHGetSpecialFolderPathW

mpr

WNetCloseEnum WNetEnumResourceW WNetOpenEnumW

shlwapi

PathFindFileNameW StrStrW

crypt32

CryptStringToBinaryA CryptDecodeObjectEx CryptImportPublicKeyInfo

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW