Overview

overview

10

Static

static

3

10bce0ff65...da.exe

windows7-x64

9

10bce0ff65...da.exe

windows10-2004-x64

10

Resubmissions

28-02-2024 18:31

240228-w6jpgsah67 10

28-02-2024 18:30

240228-w5h2kaag7s 10

11-01-2024 08:38

240111-kj2e8sddf8 10

11-01-2024 08:35

240111-kg362sddb7 10

26-07-2021 12:39

210726-18w9pcbxzs 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da.sample

  • Size

    1.3MB

  • Sample

    240228-w5h2kaag7s

  • MD5

    9f05994819a3d8c1a3769352c7c39d1d

  • SHA1

    eb2457196e04dfdd54f70bd32ed02ae854d45bc0

  • SHA256

    10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da

  • SHA512

    32cac848f47a0096773435c6365fcbd6bdb02115aae2677aec5a86031b6def938033210fdcf0e12f735aa5ceb8cd4be5f7edb5cdc437bbca61f0d79196ec9be8

  • SSDEEP

    24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkzVZgMCST:L7XP7P9o5QzUtl1fpxkzVZgMCA

Score
10/10
dearcryransomware

Malware Config

Extracted

Path

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\readme.txt

Family

dearcry

Ransom Note
Your file has been encrypted! If you want to decrypt, please contact us. [email protected] or [email protected] And please send me the following hash! 2133c369fb115ea61eebd7b62768decf

Targets

    • Target

      10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da.sample

    • Size

      1.3MB

    • MD5

      9f05994819a3d8c1a3769352c7c39d1d

    • SHA1

      eb2457196e04dfdd54f70bd32ed02ae854d45bc0

    • SHA256

      10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da

    • SHA512

      32cac848f47a0096773435c6365fcbd6bdb02115aae2677aec5a86031b6def938033210fdcf0e12f735aa5ceb8cd4be5f7edb5cdc437bbca61f0d79196ec9be8

    • SSDEEP

      24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkzVZgMCST:L7XP7P9o5QzUtl1fpxkzVZgMCA

    Score
    10/10
    ransomwaredearcry

    • DearCry

      DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.

      ransomwaredearcry

    • Renames multiple (2786) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks