General

  • Target

    8a6de728e7a12c269c2260ca31c684962ee64e5e6a6688b8fd2dab09b8462120.exe

  • Size

    707KB

  • MD5

    eaceefd4eb93e1b1d0206312752a681d

  • SHA1

    bf2e785ac4ffb2b12248d1da363ba1c85f42599e

  • SHA256

    8a6de728e7a12c269c2260ca31c684962ee64e5e6a6688b8fd2dab09b8462120

  • SHA512

    6820973d94458d9df2c91c9673b98b5e8114723e8badeb462d0b54b68407484c0f15142b56d7c707de7477d664f1c536b03031a30a19c67d0de264a5ce417ce3

  • SSDEEP

    6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1U8vvnh:6uaTmkZJ+naie5OTamgEoKxLWXnh

Score
10/10

Malware Config

Signatures

  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 1 IoCs
  • Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 8a6de728e7a12c269c2260ca31c684962ee64e5e6a6688b8fd2dab09b8462120.exe
    .exe windows:5 windows x86 arch:x86

    2f7da257a3159bdb9faeb823ef872a56


    Headers

    Imports

    Sections