Overview

overview

10

Static

static

10

Alex-2023-...2).zip

windows7-x64

1

Alex-2023-...2).zip

windows10-2004-x64

1

037f9434e8...53.ps1

windows7-x64

1

037f9434e8...53.ps1

windows10-2004-x64

1

05194b34f8...d4.exe

windows7-x64

1

05194b34f8...d4.exe

windows10-2004-x64

1

1285e648ef...9709ff

ubuntu-18.04-amd64

3

159fbb0d04...783614

windows7-x64

1

159fbb0d04...783614

windows10-2004-x64

1

1db1c4bf74...e85efd

ubuntu-18.04-amd64

1

1db1c4bf74...e85efd

debian-9-armhf

1

1db1c4bf74...e85efd

debian-9-mips

1

1db1c4bf74...e85efd

debian-9-mipsel

1

29dd920ac1...e5.zip

windows7-x64

1

29dd920ac1...e5.zip

windows10-2004-x64

1

2001.exe

windows7-x64

9

2001.exe

windows10-2004-x64

9

2bb60b1a8a...21.exe

windows7-x64

10

2bb60b1a8a...21.exe

windows10-2004-x64

10

6698f8ffb7...880c94

windows7-x64

1

6698f8ffb7...880c94

windows10-2004-x64

1

6c109d098a...8e.exe

windows7-x64

10

6c109d098a...8e.exe

windows10-2004-x64

10

70d176272e...ef.exe

windows7-x64

1

70d176272e...ef.exe

windows10-2004-x64

1

742d89c0c1...a1.exe

windows7-x64

9

742d89c0c1...a1.exe

windows10-2004-x64

9

75cd1339c8...bc.zip

windows7-x64

1

75cd1339c8...bc.zip

windows10-2004-x64

1

Dimples#1337.jar

windows7-x64

1

Dimples#1337.jar

windows10-2004-x64

7

832e563eb3...0cee4c

windows7-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Alex-2023-08-01-52-ransomware-samples (2).zip

  • Size

    343KB

  • MD5

    2a1fe9e74da9d2a717996414590d5b13

  • SHA1

    fc8dc10b1f18d5ffb320419bd758aa17367c4856

  • SHA256

    7529970855e64a5bef4c31b4670348e21810c56ccc1bfaba8ddfd50cf483b863

  • SHA512

    1ceb6f2e35e2ccbbf861b133bf33f5f8cbe6eec7b0bbf1bee71dc2b6f1e8c4a202877e8efad82dfc801c32a487817febafcb6f842b5864b3a5610617d15a0c87

  • SSDEEP

    6144:RBmiEaUTKuYGf4KplFOU6OIx7QIdy1Nzeg6+1z8Qs:RBc6N7kt66z2

Score
10/10
upxpurecrypter

Malware Config

Extracted

Family

purecrypter

C2

http://80.66.75.116/Kkxdfj.dll

http://80.66.75.116/Qknmsxijajg.bmp

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://110.40.169.19:8080/taViSsz.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://65.108.157.150/system.bat

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://80.66.75.37/p-Bxcrtduklp.exe

Signatures

  • Purecrypter family
    purecrypter
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

Files

  • Alex-2023-08-01-52-ransomware-samples (2).zip
    .zip
  • 037f9434e83919506544aa04fecd7f56446a7cc65ee03ac0a11570cf4f607853
    .ps1
  • 05194b34f8ff89facdd7b56d05826b08edaec9c6e444bdc32913e02cab01afd4
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 1285e648efbbeb50a2dddcd622a2230690975eb68cb05fdf0873ed3d359709ff
    .elf linux x64
  • 159fbb0d04c1a77d434ce3810d1e2c659fda0a5703c9d06f89ee8dc556783614
  • 1db1c4bf74d0aca8e06a007701899c93be174a9391a74f5258f03149a0e85efd
    .sh linux
  • 29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5
    .zip
  • 2001.exe
    .exe windows:6 windows x86 arch:x86

    65f731597048104980e8041a141b37d6


    Headers

    Imports

    Sections

  • 2bb60b1a8a0a1ee7c5eb44306f6007891ff95c39b851f74ec609481e0dd08321
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6698f8ffb7ba04c2496634ff69b0a3de9537716cfc8f76d1cfea419dbd880c94
  • 6c109d098a1f44017f3937a71628d9dbd4d2ca8aa266656ee4720c37cc31558e
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 70d176272ef4e088bbaf2f1db5658131e2b99bdb5c2a2f89bb522c900d8a2def
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 742d89c0c1e345a4b2197f3e25b293d7126acfaf954c99243047a6c07003f5a1
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 75cd1339c8bd95dd4340bb8be524ec098fd18a80c242e0e0f8da3bbbccd641bc
    .zip

    Password: infected

  • Dimples#1337.jar
    .jar
  • 832e563eb312cfaa4dba012f2350e188be5ed6f62eab38b209f4abe7dc0cee4c
  • 8e54c38bc3585c3163c3e25d037bcf55695c274aaea770f2f59f0a0910a4b572
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8ebf2ae4c362f76d402703efe3dc095901f2d78917f88a520b67584a7d8f291e
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96dc75ef1fa3a7ce1f9cbeb091bf76da163440719220b1d52336c61b137c62b7
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9e3684be0b4c2dc93f962c03275e050fed57d9be6411396f51bdf8d4bb5e21c0
  • ba97fd533e8a552664695434227b24ca1e2e661c360a7a0a40ff59ba6b8fe949
    .ps1
  • be6416218e2b1a879e33e0517bcacaefccab6ad2f511de07eebd88821027f92d
  • be7995134d2918680c9c14dcb0f9986bfca8ad68ee69a754afb4c8d1b4af815d
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • c2b11dc7c33e79ac1532efd0d671ea99f34cfa630deab3b45ee5c32660d38d0d
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • cb47327c7cce30cff8962c48fa3b51e57e331e1592ea78b21589164c5396ccd9
  • ee884ee08474f7153c3acea1cbb8d81e679415c1d87d597e23172e0b8e3ba78e
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • f7be8012895d7cae29cf945e88e064389770e7dcc3e9160348cef16e26be14e6
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • fd0030883b9e74b383ee6381a2aaa7e2e5b93a00003b555e2f7c8b7be65ab176
    .ps1
  • fead3d518752ddb4d2407f16ca5f3c9b3c0bf01972a2618369d02913f7c6af1a
    .ps1