clop | jsFhhfngkaDj[.]exe

Target
jsFhhfngkaDj.exe
Size 936KB
Sample230724-sa2zeaee77
SHA256 a9741b16f4169f56ae0f2e49c87f3c5360ed5ab4370e6d16bd86179999f11795
MD5 8bd774fbc6f846992abda69ddabc3fb7
SHA1 a6e940b1bd92864b742fbd5ed9b2ef763d788ea7
SHA512 037c1f895d3bb44e5f37abec7202325639d6414cab71df88663b573a04a5f8d9cd3f5939fdcfdec995cec35f6e3ed2f905b78270522ffdd98f7e2a93106d6480
SSDEEP 24576:zw71/dET5/y1ufQfvDN3y60HyOci+MIjxnGxs:Q1FWq1ufwrVy60HWMIVGK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

clop

Malware Config

Signatures

Clop family
clop

Detects Clop payload 1 IoCs

resource	yara_rule
sample	family_clop

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jsFhhfngkaDj.exe

File Explorer

jsFhhfngkaDj.exe

.exe 936KB

jsFhhfngkaDj.exe

IMPHASH 6343fa0399258ac183fe24b2f9f0af0c
SHA256 a9741b16f4169f56ae0f2e49c87f3c5360ed5ab4370e6d16bd86179999f11795
MD5 8bd774fbc6f846992abda69ddabc3fb7
SHA1 a6e940b1bd92864b742fbd5ed9b2ef763d788ea7
SHA512 037c1f895d3bb44e5f37abec7202325639d6414cab71df88663b573a04a5f8d9cd3f5939fdcfdec995cec35f6e3ed2f905b78270522ffdd98f7e2a93106d6480
SSDEEP 24576:zw71/dET5/y1ufQfvDN3y60HyOci+MIjxnGxs:Q1FWq1ufwrVy60HWMIVGK
MD5 SHA1 SHA512 SSDEEP

windows x86

Detects Clop payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4695

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLogicalDrives EnumResourceTypesExW GetOEMCP NotifyUILanguageChange GlobalHandle GetProcessShutdownParameters FindFirstFileA FindFirstFileExW EraseTape FindFirstVolumeW GetSystemDefaultLCID CopyFileTransactedW HeapFree SetPriorityClass GetCommandLineW FindNLSString GetCurrentProcess GetConsoleOutputCP lstrlenW GetThreadErrorMode FindFirstFileExA GetSystemDefaultUILanguage TerminateProcess GetProfileIntW LoadLibraryExA GetUserDefaultLangID GetModuleFileNameW DeleteFiber GetSystemTimes GetCommModemStatus GetConsoleCP GetThreadLocale GlobalUnWire GetProcessId GetUserDefaultUILanguage GetNamedPipeClientComputerNameW LeaveCriticalSection GetConsoleAliasW FlushProcessWriteBuffers InitializeCriticalSectionEx GetLargePageMinimum GetFileAttributesTransactedA GetPrivateProfileSectionW GetConsoleScreenBufferInfoEx lstrlenA GetEnvironmentVariableA CreateMutexA GetCurrentThreadId OpenJobObjectW MapViewOfFileExNuma lstrcmpA UnregisterApplicationRecoveryCallback GetSystemDirectoryW IsSystemResumeAutomatic GlobalDeleteAtom ContinueDebugEvent GetAtomNameW GetModuleHandleA GetSystemDefaultLangID GetACP GetSystemDefaultLocaleName RtlCaptureStackBackTrace OpenProcess GetVersion BuildCommDCBA GetCommandLineA CreateToolhelp32Snapshot CreateEventW ReadConsoleOutputCharacterA ProcessIdToSessionId GetPrivateProfileStringW Sleep CancelSynchronousIo GetTickCount64 CopyFileA GetCurrencyFormatEx EnumSystemLocalesEx Process32NextW OutputDebugStringW GetMaximumProcessorGroupCount GetThreadUILanguage GetUserDefaultLCID ReadConsoleInputA SetEvent GetLogicalProcessorInformation CreateMutexExA GetDiskFreeSpaceExW RemoveVectoredExceptionHandler AcquireSRWLockExclusive GetActiveProcessorGroupCount LoadLibraryA TlsAlloc CloseHandle GetSystemDEPPolicy Process32FirstW GetConsoleTitleA CreateThreadpoolCleanupGroup RaiseException FreeConsole QueryProcessCycleTime LoadLibraryW IsDBCSLeadByte FindResourceW HeapAlloc ClearCommError GetAtomNameA GetDefaultCommConfigW GetUserGeoID SwitchToThread IsThreadAFiber GetCurrentProcessorNumber GetSystemWow64DirectoryA SubmitThreadpoolWork GetErrorMode UnregisterApplicationRestart SetFileApisToOEM WTSGetActiveConsoleSessionId ExitProcess ReadProcessMemory GetCurrentProcessId GetProcessHeap IsValidLanguageGroup GetProfileStringW CreateSymbolicLinkW GetConsoleWindow GetLongPathNameTransactedW BuildCommDCBAndTimeoutsA GlobalUnfix CreateRemoteThread OpenFileMappingA LocaleNameToLCID GetTempFileNameW ConvertFiberToThread LocalFlags SetFileApisToANSI FormatMessageA GetTempFileNameA GetProcessPriorityBoost FindNextVolumeW lstrcmpiW InitializeSListHead GetEnvironmentStringsW lstrcmpW GetConsoleAliasExesLengthA GetDriveTypeW IsDebuggerPresent CreateTimerQueue SizeofResource LockResource LoadResource GetModuleHandleW WriteConsoleW SetFilePointerEx ReadConsoleW SetEndOfFile GetConsoleMode FlushFileBuffers HeapReAlloc HeapSize LCMapStringW GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetCPInfo IsValidCodePage FoldStringA GetConsoleAliasExesLengthW GetNamedPipeClientComputerNameA AreFileApisANSI GlobalUnlock GetTickCount MapViewOfFile CreateFileMappingW lstrcpyW GlobalLock GetCurrentThread CreateThread GlobalFree lstrcpyA GlobalAlloc lstrcatW GetLastError SetFileAttributesW ExitThread UnmapViewOfFile CreateFileW WaitForSingleObject FindClose SetFilePointer SetErrorMode VirtualAlloc WriteFile FindNextFileW GetFileType GetModuleHandleExW WideCharToMultiByte MultiByteToWideChar GetStdHandle LoadLibraryExW VirtualFree FindFirstFileW FindResourceExA ReadFile GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection SetLastError RtlUnwind GetStartupInfoW GetSystemTimeAsFileTime QueryPerformanceCounter UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent DecodePointer

user32

wsprintfW IsCharUpperW InvalidateRect CreateMenu GetDesktopWindow CharUpperW UnionRect HiliteMenuItem DefWindowProcW UnhookWindowsHook GetFocus GetClipboardViewer GetPropW CloseClipboard GetKBCodePage GetForegroundWindow LoadBitmapW TranslateMessage GetClipboardFormatNameW GetClassNameW ExcludeUpdateRgn DrawTextW CharUpperBuffW

gdi32

CreateHatchBrush CreateRectRgn SelectPalette RectInRegion SetBkColor CreateEllipticRgn Escape FillRgn ExtTextOutW GetRgnBox GetBkMode

advapi32

SetServiceStatus GetTokenInformation LookupAccountSidW RegDisablePredefinedCacheEx RevertToSelf RegCloseKey CryptAcquireContextW RegGetValueA CryptEncrypt RegisterServiceCtrlHandlerW OpenProcessToken CreateProcessAsUserW StartServiceCtrlDispatcherW RegRestoreKeyA DuplicateTokenEx

shell32

SHGetSpecialFolderPathW

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum

shlwapi

StrStrW PathFindFileNameW

crypt32

CryptStringToBinaryA CryptDecodeObjectEx CryptImportPublicKeyInfo

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

rstrtmgr

RmGetList RmStartSession RmShutdown RmEndSession RmRestart RmRegisterResources