Overview

overview

10

Static

static

3

026eb02c34...b0.exe

windows7-x64

10

026eb02c34...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    026eb02c34da452f7e5d4289c0be85b0

  • Size

    3.6MB

  • Sample

    231224-r97hhaadbr

  • MD5

    026eb02c34da452f7e5d4289c0be85b0

  • SHA1

    cc71d0e6310534b1e4e51d894c811388b72b5812

  • SHA256

    c769d18467a420260b285209c29bff106ccafc279f20dc602b9fc69d4e78c8ac

  • SHA512

    0811f0593a8aed64a6e526f0addc18b9e575df4789d04f08c36a4fa6ad62e14d6a7ce1219972dafaed4a1f44fbddd063b4cb58144b748940a45ae682c208831c

  • SSDEEP

    49152:6w6A5EYjP4F93TagGwmiS4rq+Ei88e76CjzOQmAqaAams:6w6A5EYjP1gPlBK8L3nLaA

Score
10/10
ekanszebrocybackdoorransomwaretrojan

Malware Config

Targets

    • Target

      026eb02c34da452f7e5d4289c0be85b0

    • Size

      3.6MB

    • MD5

      026eb02c34da452f7e5d4289c0be85b0

    • SHA1

      cc71d0e6310534b1e4e51d894c811388b72b5812

    • SHA256

      c769d18467a420260b285209c29bff106ccafc279f20dc602b9fc69d4e78c8ac

    • SHA512

      0811f0593a8aed64a6e526f0addc18b9e575df4789d04f08c36a4fa6ad62e14d6a7ce1219972dafaed4a1f44fbddd063b4cb58144b748940a45ae682c208831c

    • SSDEEP

      49152:6w6A5EYjP4F93TagGwmiS4rq+Ei88e76CjzOQmAqaAams:6w6A5EYjP1gPlBK8L3nLaA

    Score
    10/10
    ekanszebrocybackdoorransomwaretrojan

    • Ekans

      Variant of Snake Ransomware. Targets ICS infrastructure, known to have been used against Honda in June 2020.

      ransomwareekans

    • Ekans Ransomware

      Executable looks like Ekans ICS ransomware sample.

    • Zebrocy

      Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.

      trojanbackdoorzebrocy

    • Zebrocy Go Variant

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks