Overview

overview

10

Static

static

3

20230429a9...ck.exe

windows7-x64

10

20230429a9...ck.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    20230429a9a41236e3e9c1c6a97690db587930f7virlock.bin

  • Size

    527KB

  • Sample

    230506-zp5geaff51

  • MD5

    a9a41236e3e9c1c6a97690db587930f7

  • SHA1

    a8ec8fc039bc97dcffffc9d097a3fa560940680d

  • SHA256

    346b1b59d92da5cea008adcf621987aac751bb8efac9365e0408ae7ac96a01a0

  • SHA512

    1f749f7bd077d407eefdd7b57aa21643e13b553696c8d88b70b2fa16a0d5881646a9e49daf5ce5dcd1b4b3a4b6b06a97cfd4e0221d200370eea7c35b29d2a0c9

  • SSDEEP

    12288:M7PQWfXNACvBDPf9lAsd3D5b3Nowsuu8lKhttz3om:YQqvJPFl7d3D5TWTuujz4m

Score
10/10
evasionpersistenceransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      20230429a9a41236e3e9c1c6a97690db587930f7virlock.bin

    • Size

      527KB

    • MD5

      a9a41236e3e9c1c6a97690db587930f7

    • SHA1

      a8ec8fc039bc97dcffffc9d097a3fa560940680d

    • SHA256

      346b1b59d92da5cea008adcf621987aac751bb8efac9365e0408ae7ac96a01a0

    • SHA512

      1f749f7bd077d407eefdd7b57aa21643e13b553696c8d88b70b2fa16a0d5881646a9e49daf5ce5dcd1b4b3a4b6b06a97cfd4e0221d200370eea7c35b29d2a0c9

    • SSDEEP

      12288:M7PQWfXNACvBDPf9lAsd3D5b3Nowsuu8lKhttz3om:YQqvJPFl7d3D5TWTuujz4m

    Score
    10/10
    evasionpersistencespywarestealertrojanransomware

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks