Overview

overview

10

Static

static

3

212207f5a1...ef.exe

windows7-x64

10

212207f5a1...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    212207f5a1eb39c861ff8b080ddcd2ef

  • Size

    3.6MB

  • Sample

    231231-afdjwsdbc5

  • MD5

    212207f5a1eb39c861ff8b080ddcd2ef

  • SHA1

    4613aa3cba20966b5ce95918893df9e5053d206d

  • SHA256

    cd9c6bafeef092b670ea307caf9cd2aeb234e5232950be1181f24ab41a26a4d1

  • SHA512

    0b341c34f0590e4a4dccc1100db2f83b63241bd8fb8f95a8185fa303a24fa53270a3ab76de5d7f22260545a84ec262c218f2e2ba89f660396c3b837df3b8eaed

  • SSDEEP

    98304:aYhWM7csQQNHTdcf5KsQFHxmKUhgggggggWGqS9xkuDQZt/:aPMfzBdcU7FRahggggggg8S9xgZ9

Score
10/10
ekanszebrocybackdoorransomwaretrojan

Malware Config

Targets

    • Target

      212207f5a1eb39c861ff8b080ddcd2ef

    • Size

      3.6MB

    • MD5

      212207f5a1eb39c861ff8b080ddcd2ef

    • SHA1

      4613aa3cba20966b5ce95918893df9e5053d206d

    • SHA256

      cd9c6bafeef092b670ea307caf9cd2aeb234e5232950be1181f24ab41a26a4d1

    • SHA512

      0b341c34f0590e4a4dccc1100db2f83b63241bd8fb8f95a8185fa303a24fa53270a3ab76de5d7f22260545a84ec262c218f2e2ba89f660396c3b837df3b8eaed

    • SSDEEP

      98304:aYhWM7csQQNHTdcf5KsQFHxmKUhgggggggWGqS9xkuDQZt/:aPMfzBdcU7FRahggggggg8S9xgZ9

    Score
    10/10
    ekanszebrocybackdoorransomwaretrojan

    • Ekans

      Variant of Snake Ransomware. Targets ICS infrastructure, known to have been used against Honda in June 2020.

      ransomwareekans

    • Ekans Ransomware

      Executable looks like Ekans ICS ransomware sample.

    • Zebrocy

      Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.

      trojanbackdoorzebrocy

    • Zebrocy Go Variant

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks