General

  • Target

    f0eb8e72b98bc8d9efc098c4193ae9a9eac8c562f75e3a7108edced6bf6b8508.exe

  • Size

    707KB

  • MD5

    d35be82901461760be633107ba22e3d1

  • SHA1

    89cb1f8103ae5e76622daee670d138af9f2a57b2

  • SHA256

    f0eb8e72b98bc8d9efc098c4193ae9a9eac8c562f75e3a7108edced6bf6b8508

  • SHA512

    b35548e4500ec38cc52aa5ba738dfa01ad57abddc86470d85505e0dd09b8629e2150b6b747127ce5d2242f7882f790a1f2ad18cfd0a5268ed4d0807c383f22f7

  • SSDEEP

    6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza118Pvnh:6uaTmkZJ+naie5OTamgEoKxLWgHh

Score
10/10

Malware Config

Signatures

  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 1 IoCs
  • Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f0eb8e72b98bc8d9efc098c4193ae9a9eac8c562f75e3a7108edced6bf6b8508.exe
    .exe windows:5 windows x86 arch:x86

    2f7da257a3159bdb9faeb823ef872a56


    Headers

    Imports

    Sections