Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    Ransomware/$uckyLocker.exe

  • Size

    414KB

  • MD5

    c850f942ccf6e45230169cc4bd9eb5c8

  • SHA1

    51c647e2b150e781bd1910cac4061a2cee1daf89

  • SHA256

    86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

  • SHA512

    2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

  • SSDEEP

    6144:Av+lDAAB6fm00rx/Qdd1QkfRLT+vLtls6LEmynPsVpw/pcPk19:RdAAB6Mk1HfRLqzPlLEmynPsVpwBT

  Score

  8^/10

  evasionransomware

  • Disables Task Manager via registry modification

    evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2

• • Target

    Ransomware/7ev3n.exe

  • Size

    315KB

  • MD5

    9f8bc96c96d43ecb69f883388d228754

  • SHA1

    61ed25a706afa2f6684bb4d64f69c5fb29d20953

  • SHA256

    7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5

  • SHA512

    550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6

  • SSDEEP

    6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXv:BswRSslz0P1OdFXJlJ8buXv

  Score

  10^/10

  evasionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral3behavioral4

• • Target

    Ransomware/Annabelle.exe

  • Size

    15.9MB

  • MD5

    0f743287c9911b4b1c726c7c7edcaf7d

  • SHA1

    9760579e73095455fcbaddfe1e7e98a2bb28bfe0

  • SHA256

    716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac

  • SHA512

    2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677

  • SSDEEP

    393216:UMwm0qBknxdEX+LbMUgoSZmWSmh4aaRN22ChHCMNku1y:UMcKX+Lbjgd7W1RNVC9ku1

  Score

  10^/10

  evasionpersistenceransomwaretrojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Modifies Windows Firewall

    evasion

  • Sets file execution options in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral5behavioral6

• • Target

    Ransomware/BadRabbit.exe

  • Size

    431KB

  • MD5

    fbbdc39af1139aebba4da004475e8839

  • SHA1

    de5c8d858e6e41da715dca1c019df0bfb92d32c0

  • SHA256

    630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

  • SHA512

    74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

  • SSDEEP

    12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

  Score

  10^/10

  badrabbitmimikatzransomware

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • mimikatz is an open source tool to dump credentials on Windows

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral7behavioral8

• • Target

    Ransomware/Birele.exe

  • Size

    116KB

  • MD5

    41789c704a0eecfdd0048b4b4193e752

  • SHA1

    fb1e8385691fa3293b7cbfb9b2656cf09f20e722

  • SHA256

    b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23

  • SHA512

    76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea

  • SSDEEP

    3072:pYV/aVHN9ySTn34w33FVTyuGAxsvBLSqAKZqoqrxy031l3y:8adNlltyu3Pa5gr33

  Score

  10^/10

  persistenceupx

  • Modifies WinLogon for persistence

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral9

• • Target

    Ransomware/Cerber5.exe

  • Size

    313KB

  • MD5

    fe1bc60a95b2c2d77cd5d232296a7fa4

  • SHA1

    c07dfdea8da2da5bad036e7c2f5d37582e1cf684

  • SHA256

    b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d

  • SHA512

    266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

  • SSDEEP

    6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN

  Score

  10^/10

  cerberdiscoveryevasionransomware

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber

  • Blocklisted process makes network request

  • Contacts a large (1094) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral10behavioral11

• • Target

    Ransomware/CoronaVirus.exe

  • Size

    1.0MB

  • MD5

    055d1462f66a350d9886542d4d79bc2b

  • SHA1

    f1086d2f667d807dbb1aa362a7a809ea119f2565

  • SHA256

    dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

  • SHA512

    2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

  • SSDEEP

    24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2

  Score

  10^/10

  dharmapersistenceransomwarespywarestealer

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (325) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral12behavioral13

• • Target

    Ransomware/CryptoLocker.exe

  • Size

    338KB

  • MD5

    04fb36199787f2e3e2135611a38321eb

  • SHA1

    65559245709fe98052eb284577f1fd61c01ad20d

  • SHA256

    d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

  • SHA512

    533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

  • SSDEEP

    6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv

  Score

  10^/10

  cryptolockerpersistenceransomware

  • CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral14behavioral15

• • Target

    Ransomware/CryptoWall.exe

  • Size

    132KB

  • MD5

    919034c8efb9678f96b47a20fa6199f2

  • SHA1

    747070c74d0400cffeb28fbea17b64297f14cfbd

  • SHA256

    e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

  • SHA512

    745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

  • SSDEEP

    3072:naRQpzd/99wen3XgWorw8I3h8LkMvqCgQfBUnPy8L6kssU:nJdTwo30ri3h8LkMvqCgQfBUPy8L6ksP

  Score

  9^/10

  persistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral16behavioral17

• • Target

    Ransomware/DeriaLock.exe

  • Size

    484KB

  • MD5

    0a7b70efba0aa93d4bc0857b87ac2fcb

  • SHA1

    01a6c963b2f5f36ff21a1043587dcf921ae5f5cd

  • SHA256

    4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309

  • SHA512

    2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14

  • SSDEEP

    6144:lqHKx3YCgy8HmmjJpnVhvLqCO3bLinIz1wASx:lqHoyHNj/nVhvLcyII

  Score

  7^/10

  • Drops startup file

  behavioral18behavioral19

• • Target

    Ransomware/Dharma.exe

  • Size

    11.5MB

  • MD5

    928e37519022745490d1af1ce6f336f7

  • SHA1

    b7840242393013f2c4c136ac7407e332be075702

  • SHA256

    6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850

  • SHA512

    8040195ab2b2e15c9d5ffa13a47a61c709738d1cf5e2108e848fedf3408e5bad5f2fc5f523f170f6a80cb33a4f5612d3d60dd343d028e55cfc08cd2f6ed2947c

  • SSDEEP

    196608:JZnMy97vfgla5NX7YaP6uIEJsp+jb4agYSUpHm6g90MrYmhZZoG0tLzr1+W:LnMy9rfma5NrYaVzC0b4vpZZoG0tR+W

  Score

  9^/10

  evasionpersistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Modifies Windows Firewall

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral20behavioral21

• • Target

    Ransomware/Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

  Score

  10^/10

  fantomevasionransomware

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom

  • Renames multiple (1698) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral22behavioral23

• • Target

    Ransomware/GandCrab.exe

  • Size

    291KB

  • MD5

    e6b43b1028b6000009253344632e69c4

  • SHA1

    e536b70e3ffe309f7ae59918da471d7bf4cadd1c

  • SHA256

    bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

  • SHA512

    07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

  • SSDEEP

    6144:nSRCSpUtLz+/enihebWBUOP3yIhLVMmi0CtG7go+I:SUOEnNnHbmP3yIE3tGX

  Score

  10^/10

  gandcrabbackdoorransomwarespywarestealer

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (288) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral24behavioral25

• • Target

    Ransomware/GoldenEye/GoldenEye.exe

  • Size

    254KB

  • MD5

    e3b7d39be5e821b59636d0fe7c2944cc

  • SHA1

    00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88

  • SHA256

    389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97

  • SHA512

    8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

  • SSDEEP

    3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl:i6nrD0ZMcPBAL7c0fTHs+2sYXg

  Score

  10^/10

  metasploitbackdoorbootkitpersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral26behavioral27

• • Target

    Ransomware/GoldenEye/GoldenEye.js

  • Size

    365KB

  • MD5

    c4e9fc349d5c8b24c0ddb1533de2c16b

  • SHA1

    147e938bd06709b3c20eea4ac461093d573be037

  • SHA256

    28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71

  • SHA512

    fd0cf6f434e665aabc91f6095394a08483990c12a0b6ad3a1bd820b740af0ddbc02bc0a2592be429c7488b3cd2889afad8f758b4258009dfe51e9faac76842be

  • SSDEEP

    6144:Jnm5mwYxm+DzkzFIDIWCy49ezGywT7PDSzT3enlJ1BJ0exGqkIb1Taha6e2T6Huv:FnaIEWeqWdnlhJ+eHHu+1Qk3C+MAQ

  Score

  10^/10

  metasploitbackdoorbootkitpersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral28behavioral29

• • Target

    Ransomware/InfinityCrypt.exe

  • Size

    211KB

  • MD5

    b805db8f6a84475ef76b795b0d1ed6ae

  • SHA1

    7711cb4873e58b7adcf2a2b047b090e78d10c75b

  • SHA256

    f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

  • SHA512

    62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

  • SSDEEP

    1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbM:rCVC303p22sZrRQpnviB832Du9WMON

  Score

  10^/10

  infinitylockransomware

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock
  behavioral30behavioral31

• • Target

    Ransomware/Krotten.exe

  • Size

    53KB

  • MD5

    87ccd6f4ec0e6b706d65550f90b0e3c7

  • SHA1

    213e6624bff6064c016b9cdc15d5365823c01f5f

  • SHA256

    e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4

  • SHA512

    a72403d462e2e2e181dbdabfcc02889f001387943571391befed491aaecba830b0869bdd4d82bca137bd4061bbbfb692871b1b4622c4a7d9f16792c60999c990

  • SSDEEP

    768:4yKoNLsn4Jp9ZvRInygrpMoZN+WtOl08jxBEHCDwBLpZTPCUvQK:j/sn4/OycxZN+MKxp8t9zQK

  Score

  8^/10

  evasionpersistence

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence
  behavioral32