Overview

overview

9

Static

static

7

NOBLIS RANSOMWARE.exe

windows7-x64

7

NOBLIS RANSOMWARE.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NOBLIS RANSOMWARE.bin.zip

  • Size

    7.0MB

  • Sample

    231013-dtd95acb9x

  • MD5

    2990b9b8bb30054d5d0f8e787831a641

  • SHA1

    8a3352878d43e77d36921d7c8ca43b164cf5a8f2

  • SHA256

    4cd12497eab4212904d1be1146412cb49f41b4921f1930aa25a34f1bcdf886be

  • SHA512

    36918c406803bcb92da78ce6d563c89557ffe46bb046ba69f5841adc2ff07caf7b8fdfc1119397f8c899235e6bda17ca9c90e91efd208ac6d42588b36baaafa9

  • SSDEEP

    196608:g10IacnsGa1NowBz3l9KCTLzHw4wKCzipUZMYe:u0IxS1JzlDw4KiUpe

Score
9/10
pyinstallerransomwarespywarestealerupx

Malware Config

Targets

    • Target

      NOBLIS RANSOMWARE.bin

    • Size

      7.0MB

    • MD5

      3beee8d7f55cd8298fcb009aa6ef6aae

    • SHA1

      672a992ea934a0cba07ca07b80b62493e95c584d

    • SHA256

      f0c292785905838d08b27bb99ab260b43fd8de580de80017fdaaab3c3d53d8a6

    • SHA512

      12bd64d10620c1952127c125e7beb21b3727d8afb6440d48058785267b227a534ee6112d84372749496481cb6edb5c90eeb159689b443fe0f10f4a9202a83a5f

    • SSDEEP

      196608:gUWfTu5s5E6s6eLL1mkJ2Z9Jq5dOYo+SJVTXOD0ch:gUWfTuK5E6s6sBmKk9JMo5/eN

    Score
    9/10
    spywarestealerupxransomware

    • Renames multiple (81) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks