Overview

overview

9

Static

static

3

sample.exe

windows7-x64

9

sample.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    9fb8f797f53dceb4731688f8688eccbe7d137665d7f2542070e2b2cf7371a6ce.bin.sample.gz
  • Size 70KB
  • Sample231022-vaxe2adb43
  • SHA256 4c5421c4feb711987c274d4a52d9dcb3dd8732ec076109989039da7093bf2ad0
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
ransomware

Malware Config

Targets

    • Target
      sample
    • Size 129KB
    • SHA256 9fb8f797f53dceb4731688f8688eccbe7d137665d7f2542070e2b2cf7371a6ce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Renames multiple (3045) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Renames multiple (497) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks