Analysis
-
max time network
75s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
10/01/2024, 18:01
General
-
Target
0407f464f5383cc888945bda2afa42c6.exe
-
Size
723KB
-
MD5
0407f464f5383cc888945bda2afa42c6
-
SHA1
92de3404b2b42c0460565201ceaf2669bd6fc149
-
SHA256
cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20
-
SHA512
39aabd70c7065714718c0cb91795b1e690972780e1c118cb0f71f7f481f889f1df36b2e4b17b2e791ac8ef477c69f412a00f51bde9eec9e3c7531498c5586e50
-
SSDEEP
12288:qKWz9fNdRDFUssQkmmhlew/2NSFaanti7JDaDN79dOCOMW+/jeV/sJ/oftN2y2Eh:nQ9pDFUs1kzhlew/uSFBtilDaDNpd3xE
Score
10/10
Malware Config
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.