General

  • Target

    fd9fa4406746e622305f6274747b39e97a8eddbf9460ae915f59e7aa0fb61d21.exe

  • Size

    707KB

  • MD5

    a2d9d9850b1679961e8c5ae8d73ebf84

  • SHA1

    e8e00abb42aa2b4fa36d31ee56c1751765a9237e

  • SHA256

    fd9fa4406746e622305f6274747b39e97a8eddbf9460ae915f59e7aa0fb61d21

  • SHA512

    192a4cffb4d32644dccd4c545e9cbed2bac4011ad93c60bb0c7c578063e563b31aea3fe293ad4a5eca2244baf9bff69868ce9c72e57a5bb7f403deefb48154f8

  • SSDEEP

    6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1Q8Rvnh:6uaTmkZJ+naie5OTamgEoKxLW7Fh

Score
10/10

Malware Config

Signatures

  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 1 IoCs
  • Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • fd9fa4406746e622305f6274747b39e97a8eddbf9460ae915f59e7aa0fb61d21.exe
    .exe windows:5 windows x86 arch:x86

    2f7da257a3159bdb9faeb823ef872a56


    Headers

    Imports

    Sections