Extracted

• • Target
    wave.png
  • Size 10KB
  • SHA256 986eb45b5d5c04fee9e2bfcbbc15b968870e40feda870eb949ef10c2b7b73c1e
  • MD5 57bd5782b784673f8e3ebd06f95bdf38
  • SHA1 1f55e36180024eb5c8fc066a855287898e6b077a
  • SHA512 9f807db1571b942467f61b2d9a7ef11882036f64a6e1347ede55523deb9da193ec8255be0819e16cac65595f67f05bbf80320c9d46c4e1bf944b34dd000ffe51
  • SSDEEP 192:sD2HxgUkULWcH4F4/XZ/g4t688FPhzBfZIYeLhl+1/RNqeyFgbCBQJGSz/2Niq:sDXEicYF4/XZ/HT8FPhzMHNQdql0CBQ2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  badrabbitmetasploitmimikatzbackdoorbootkitevasionpersistenceransomwaretrojan

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • mimikatz is an open source tool to dump credentials on Windows

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2