Overview

overview

10

Static

static

3

260441ed9d...74.exe

windows7-x64

10

260441ed9d...74.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    260441ed9d2a0fb7db58c1b904c7c374

  • Size

    241KB

  • Sample

    231231-dr2bwaaac6

  • MD5

    260441ed9d2a0fb7db58c1b904c7c374

  • SHA1

    b0c88807180389872df34dd98b1e3bdbc1a6f6e9

  • SHA256

    d67091e8079d0dcf4f3962628e4f7520309a8111750082218c3be89a8fa70e3d

  • SHA512

    3aa5326cd6a49f117e2097c457fdf85c0fcf88e39fd0966893504da9cb13cd16275a444336e49462edc2e375cbf888d543184fdb2be00ce71716f2f695fd6005

  • SSDEEP

    6144:PXyH5a0vECLJg6bEmNAgGA1C4PGtv13T:6H5zY6bRKgGA1CkY9

Score
10/10
zeppelinransomware

Malware Config

Targets

    • Target

      260441ed9d2a0fb7db58c1b904c7c374

    • Size

      241KB

    • MD5

      260441ed9d2a0fb7db58c1b904c7c374

    • SHA1

      b0c88807180389872df34dd98b1e3bdbc1a6f6e9

    • SHA256

      d67091e8079d0dcf4f3962628e4f7520309a8111750082218c3be89a8fa70e3d

    • SHA512

      3aa5326cd6a49f117e2097c457fdf85c0fcf88e39fd0966893504da9cb13cd16275a444336e49462edc2e375cbf888d543184fdb2be00ce71716f2f695fd6005

    • SSDEEP

      6144:PXyH5a0vECLJg6bEmNAgGA1C4PGtv13T:6H5zY6bRKgGA1CkY9

    Score
    10/10
    zeppelinransomware

    • Detects Zeppelin payload

    • Zeppelin Ransomware

      Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

      ransomwarezeppelin

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks