Extracted

• • Target

    wave.png

  • Size

    10KB

  • MD5

    57bd5782b784673f8e3ebd06f95bdf38

  • SHA1

    1f55e36180024eb5c8fc066a855287898e6b077a

  • SHA256

    986eb45b5d5c04fee9e2bfcbbc15b968870e40feda870eb949ef10c2b7b73c1e

  • SHA512

    9f807db1571b942467f61b2d9a7ef11882036f64a6e1347ede55523deb9da193ec8255be0819e16cac65595f67f05bbf80320c9d46c4e1bf944b34dd000ffe51

  • SSDEEP

    192:sD2HxgUkULWcH4F4/XZ/g4t688FPhzBfZIYeLhl+1/RNqeyFgbCBQJGSz/2Niq:sDXEicYF4/XZ/HT8FPhzMHNQdql0CBQ2

  Score

  10^/10

  badrabbitmetasploitmimikatzbackdoorbootkitevasionpersistenceransomwaretrojan

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • mimikatz is an open source tool to dump credentials on Windows

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2