Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    3da65a0e613fadcff41992bd4f74b7dc1e71f9cb542339679185f79de6503f0e.bin

  • Size

    72KB

  • MD5

    c12a9eae7b63f5bdd90deb3969079492

  • SHA1

    f0700457e66091be7222748c7170881608d3a0cd

  • SHA256

    3da65a0e613fadcff41992bd4f74b7dc1e71f9cb542339679185f79de6503f0e

  • SHA512

    44270af6f6fed42dcb190f0761714bdc1a4888197f3d19f1c6c1d694138e54b17ec9403ff24658ee6a9e7379fceaae1e727ccefe512b26818e2310669fbeabc9

  • SSDEEP

    1536:1ODavnxrn1hV6tXqHa0Fyp7Sz4C4OKqlmAC+YyWd4AEZswQUI5GLy:AoV6puaMypmMTOK/41krQ+

  Score

  10^/10

  persistenceransomwarespywarestealer

  • Renames multiple (6123) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2

• • Target

    Ransomware/Alphabet.bin

  • Size

    168KB

  • MD5

    dbe78231174b03239eb262cc2d2d0900

  • SHA1

    fc472223cd9aee3cf912fc401bd47774569d07ac

  • SHA256

    4e60f3c8eaa0441d4ffdced18aa04153bb91b5470bc5441ba5878f7760ca9b5b

  • SHA512

    27561377d217c449e4730a0eab69cd1edd68480ea22e6b3c8fee0e76603acc36cbc420c204b3ecf98f0dde4cf731cad6937751c780c796c7192a84ad1823d2ba

  • SSDEEP

    1536:rBUzOE+2x+/m2x+kDgJF+2x+/m2x+kDgWGekNsGekNFuJGekNsGekNcl:wOE1+l+kcJF1+l+kctphpG

  Score

  8^/10

  persistence

  • Modifies Installed Components in the registry

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4

• • Target

    Ransomware/Atom Payload Builder.exe

  • Size

    513KB

  • MD5

    224db51b372a5a26f3e09d2a64af50b2

  • SHA1

    bca07e1a05bc30bbf51ccfdc34676fc574b790d7

  • SHA256

    5ab04878b630d1e0598fb6f74570f653a6bd0753dad9ef55ecf467bee7e618e1

  • SHA512

    f031ee3a4307bddffcf9809f3e4d778a5f8ebe1d53ba8fde13bd1c6248e93e8e479ddb21dca9a201aaa261c4111eee2c21a241fbe3087f9eb777bccc542163de

  • SSDEEP

    12288:amhp5zFkcxdQ8r0R3gYR3nxdJYEm5ATgulc/:3BZoR3gYR3nFmBulc

  Score

  1^/10
  behavioral5behavioral6

• • Target

    Ransomware/Cerber

  • Size

    492KB

  • MD5

    8b3d0bc69064a0155a205a4202417330

  • SHA1

    0aa06a222900a2d3042e73fc21b52004d7856aeb

  • SHA256

    9ef7fe10bbbb58899859d82ba7a698cbfdd546c6e9e4d3b55193e4180682036c

  • SHA512

    e54140bdf79b5498cb7f4a519a4d9ed54e3a4845ae822a2f25c3f1d97b616b9f1374ece7ff788e0e667e5ac5824f81aa1a1861b8d212e832533590ac1f96633a

  • SSDEEP

    12288:ww+dKNr2YH7WQx3IjKoa+888888888888W888888888888:wVKMYbWzuBf

  Score

  10^/10

  cerberdiscoveryevasionransomware

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber

  • Blocklisted process makes network request

  • Contacts a large (1094) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral7behavioral8

• • Target

    Ransomware/EternalRocks

  • Size

    5.0MB

  • MD5

    53f23e72664dc9efd4251ba1b120d932

  • SHA1

    5e033b70775429fb6a5c2f40435984526f3a4ca1

  • SHA256

    3b4497c7f8c89bf22c984854ac7603573a53b95ed147e80c0f19e549e2b65693

  • SHA512

    fad16aeff2bc7ff24eba061167769d40ef228fc986c3a6ca3cabb5e42625bd22a7a9745cabe551b089d8361305f92bc1786b40e2f00d185a9e524e0935f867f5

  • SSDEEP

    98304:SX/pvSmTsOmMpu5l/sB0seyAp/QszFjXEKZFbr0vKPMKznq:EBvpsOmX5ly0sbAtVXEKZF+sVq

  Score

  1^/10
  behavioral10behavioral9

• • Target

    Ransomware/GLOBEIMPOSTER

  • Size

    232KB

  • MD5

    1bbd2dc9746292c60121865663b287f2

  • SHA1

    04644335ef7523274146a4f39ab30621c2a2a9a1

  • SHA256

    2815c8cdb02003298f7959fd1cf6eed893de6652f3861a6a2e3e5744b8ac9234

  • SHA512

    da557f37abac2300ee03e4167d1dbf9d06d7f6faa6af887fb0966de4c3c7d35117f8ca0cee6e5d68d9ba091ab9464eb1a4b601a759c3b860b141afc346a0da66

  • SSDEEP

    6144:6pSie0JHvaS7MTqp4Re4jjMXn3lNv8en:6pUSPaSkqp4RtMlhh

  Score

  10^/10

  ransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (8643) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral11behavioral12

• • Target

    Ransomware/GhostCrypter.bin

  • Size

    87KB

  • MD5

    d60b0083605a9fb10b4d21005f1febd0

  • SHA1

    ed538f9dc4a7b58649d55b892e4a32cfb25b98a1

  • SHA256

    eae568e1a06b6dd762c92a8e0be5349c0c474ff429785fdad7d58083a10485de

  • SHA512

    4c8b4e93685852cc4634f2cc2bd66ff86b2e133b9f6899441488b630569c26832eab07b08ced87b62031749969bb9c0d2e1fd229071213ed71eeaa9f27fb87cb

  • SSDEEP

    1536:NcMqI3TJ38pY5GuncfTpgg5qKB3gg5bwFlG3zg4llJLmA+pVStv:Nck3TJ38pY5OfTpTpggSHGblzL8S

  Score

  9^/10

  persistenceransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral13behavioral14

• • Target

    Ransomware/Golden Eyes - via unikey.exe

  • Size

    1.3MB

  • MD5

    3f6bfaa577b7be13705f41cc5b6cb1eb

  • SHA1

    0a9cd77276ac62848eeb1c428cf9f05c0e0ec69c

  • SHA256

    21780731ba0394eaa38254960f445321f2ca10450623855d8e2f1d6e30481022

  • SHA512

    9f02e7fc31f7fe3ebebebc4b38f49cd885f91b5bc3ee0b7c0cb2f19f2e8f983aebf671197471b61f624dbc13183bac66f8c19d50fb3a501c269ea3d1a9029ce1

  • SSDEEP

    24576:/7blFG2wAhxKw0cDJ/ztH6NtCsL96AEwZIOd++kD4mRkdqbhm:/75o2FfKwT1/x2btFtsTD4mRkdqbhm

  Score

  10^/10

  metasploitneshtabackdoorbootkitdiscoverypersistencespywarestealertrojan

  • Detect Neshta payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral15behavioral16

• • Target

    Ransomware/Locky

  • Size

    180KB

  • MD5

    b06d9dd17c69ed2ae75d9e40b2631b42

  • SHA1

    b606aaa402bfe4a15ef80165e964d384f25564e4

  • SHA256

    bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3

  • SHA512

    8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c

  • SSDEEP

    3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6

  Score

  10^/10

  lockyransomware

  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky
  behavioral17behavioral18

• • Target

    Ransomware/Matsnu.com_

  • Size

    102KB

  • MD5

    1b2d2a4b97c7c2727d571bbf9376f54f

  • SHA1

    1fc29938ec5c209ba900247d2919069b320d33b0

  • SHA256

    7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e

  • SHA512

    506fc96423e5e2e38078806591e09a6eb3cf924eb748af528f7315aa0b929890823798a3ef2a5809c14023c3ff8a3db36277bc90c7b099218422aafa4e0c2ee0

  • SSDEEP

    1536:jj+Rj1lGIXKSmE17v97yiqHGMRPtbsLW8/V2k12v1/BDxVyCfCrCAc:jjw6Sf0iqmMnb2W02v3mCf4Nc

  Score

  7^/10

  persistenceupx

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral19behavioral20

• • Target

    Ransomware/Rex

  • Size

    7.3MB

  • MD5

    5bd44a35094fe6f7794d895122ddfa62

  • SHA1

    98172e49c3d5d70ffdcefd071f9762c58430a393

  • SHA256

    762a4f2bf5ea4ff72fce674da1adf29f0b9357be18de4cd992d79198c56bb514

  • SHA512

    4033c7335a44a7536a3980aad8cf18ff6336186d71dd7b7f02c3d5c93001ed974285fe9fbbf783bc0abac3e3b3581993ad6d2ac285249aa24b0aafa261f74de8

  • SSDEEP

    49152:mNLLdMtTbVDtCsN5laK2BfCDvI7ZR9kAs5dkPjU2NhYCWpdLJaDSfUGZnh7X3cM9:mNlMt1tCsN5LGfCL7ATfscS8QhXP

  Score

  9^/10

  discovery

  • Contacts a large (11706) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral21

• • Target

    Ransomware/ShellLocker.exe

  • Size

    679KB

  • MD5

    5f3a3ee275a03ac1c2fa5482649b6471

  • SHA1

    9673a5a87428e3b38e65f2cd922946d47c4a329b

  • SHA256

    c9661b2f5274b1835d64e6d58ea5a8ff58ffa8d9d19a9a31bd43f074c6e2eb69

  • SHA512

    405139d37c3ec224f96316a59b2764d159d750d480acbbbc77c7bb8f46d9709dbcbea60cfe6d6f500d72e4b23b88ac52951bf13fb34ad81ffde9d5c32b0fb46a

  • SSDEEP

    12288:/W3FwqcxVUmAb35S9DLF4YMQ9WhueDFEkSstBZfMUpqv:/W3FwqcxKmgBkW8dstXEUpqv

  Score

  1^/10
  behavioral22behavioral23

• • Target

    Ransomware/Unlock92.bin

  • Size

    24KB

  • MD5

    afe4fa37dbbe91319f0684bc9524e557

  • SHA1

    db412ecb113e8f40781105af0d3dbc67760a9461

  • SHA256

    639f0ebcb2349caf7ab5f34e0d7c156db660f54f621fa9c2151c9f5795528670

  • SHA512

    83d7730a0213c98c4c9d5e8d195eab9c73362824d541df6e68e0106b409be756db4db2317f9ed2796de2e5bb86bdbf9195c0b8c6d91b8986df9ebe58c3603da7

  • SSDEEP

    384:TPDGsgnqFmaPJB4hWMhX5fLhMYQJtz0F92nudaTfrnnnwKPjDKcsujYcV6SUwJF9:DDGbQ/8WMN5frVF9qnnfPfZYcV6lw9b

  Score

  9^/10

  ransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (661) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral24behavioral25

• • Target

    Ransomware/cryptowall.bin

  • Size

    240KB

  • MD5

    47363b94cee907e2b8926c1be61150c7

  • SHA1

    ca963033b9a285b8cd0044df38146a932c838071

  • SHA256

    45317968759d3e37282ceb75149f627d648534c5b4685f6da3966d8f6fca662d

  • SHA512

    93dfaafc183360829448887a112dd49c90ec5fe50dcd7c7bbc06c1c8daa206eeea5577f726d906446322c731d0520e93700d5ff9cefd730fba347c72b7325068

  • SSDEEP

    3072:xkeyloECBch6ZCGBGSmHJ0y5lj6jdojK7+MGOXpXx8z3Lp7Yoq:xGlnCIwMpj6ijKfxx8z3F0V

  Score

  9^/10

  persistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral26behavioral27

• • Target

    Ransomware/eda2.exe

  • Size

    208KB

  • MD5

    9ed4b9ace2563ce02973e94999e5081e

  • SHA1

    7c69fd4f8650370ce07d18436ee4a44185f4f529

  • SHA256

    fa2a9561a0cfc535908b8b39168391d4f87c685e8d95f52a51d194cc7264ba37

  • SHA512

    6d48b956cbfc2d1a27a89e082bd7f914b5aeac8e00339a961cd1a18bab860185a64bb471f71e69e4bd1cacb801f57df140dffe7fd6b5b007eb2ec4b5540f8031

  • SSDEEP

    3072:etRM+lmsolAIrRuw+mqv9j1MWLQ5MTmmsolNIrRuw+mqv9j1MWLQ5:1+lDAArTmDAN

  Score

  1^/10
  behavioral28behavioral29

• • Target

    Ransomware/jigsaw

  • Size

    283KB

  • MD5

    2773e3dc59472296cb0024ba7715a64e

  • SHA1

    27d99fbca067f478bb91cdbcb92f13a828b00859

  • SHA256

    3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

  • SHA512

    6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

  • SSDEEP

    6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX

  Score

  10^/10

  jigsawpersistenceransomwarespywarestealer

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw

  • Renames multiple (1997) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral30behavioral31

• • Target

    Ransomware/mamba.exe

  • Size

    2.3MB

  • MD5

    409d80bb94645fbc4a1fa61c07806883

  • SHA1

    4080bb3a28c2946fd9b72f6b51fe15de74cbb1e1

  • SHA256

    2ecc525177ed52c74ddaaacd47ad513450e85c01f2616bf179be5b576164bf63

  • SHA512

    a99a2f17d9fbb1da9fb993b976df63afa74317666eca46d1f04e7e6e24149547d1ac7210f673caeae9b23a900528ad6ad0a7b98780eff458d3d505029a06e9ba

  • SSDEEP

    49152:XM16E7qUoM5NWX7DP+1egOhcraQzK6j97V:c16/rM5oW1ZrRz

  Score

  1^/10
  behavioral32