Behavioral task
behavioral1
Sample
2023-04-15_3f9e1c7638b6d4710eccb97b40aabe08_nefilim.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-04-15_3f9e1c7638b6d4710eccb97b40aabe08_nefilim.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-04-15_3f9e1c7638b6d4710eccb97b40aabe08_nefilim
-
Size
70KB
-
MD5
3f9e1c7638b6d4710eccb97b40aabe08
-
SHA1
f262ee7ffe0ff40b8c6ae07c12b539f160f41e85
-
SHA256
7dfcf790000d34b4c85d6e36e3564bdd2b8cc9ff326309a0726d0786293d0073
-
SHA512
2d15a519ef24d88a4527e07cc0f39230fd3f737980605f3a4360f559ea85bc84cb3dac6574a1e627743b1685616df315b43cde9e726bcb047172610715a47564
-
SSDEEP
768:lXStkFWTBhyugDC60CPJkEBx9w7mSDh3vkkjvshT3ED18nv04ZJqpb348Uq1krHE:liMWV3gDCk6EBwT/kJbvKbuq1krj0x
Malware Config
Signatures
-
Nefilim family
-
Nefilim ransomware executable 1 IoCs
File contains patterns typical of Nefilim samples.
Processes:
resource yara_rule sample nefilim_ransomware
Files
-
2023-04-15_3f9e1c7638b6d4710eccb97b40aabe08_nefilim.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ