Overview

overview

10

Static

static

10

2024-03-14...pcrypt

ubuntu-18.04-amd64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-03-14_c20200ae3c8acb3aa23a9097b6099739_qnapcrypt

  • Size

    4.7MB

  • Sample

    240314-d3yecsbg88

  • MD5

    c20200ae3c8acb3aa23a9097b6099739

  • SHA1

    df920c349a310f6a1532ed05f524f400e85603b3

  • SHA256

    55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567

  • SHA512

    340e157afe4f7b0800009bb220be56dcaffb0b41409935a4730fcfe6f4775960b1aaa0d804d0a0fbcfb47d451cf8c1b2c17cc2211c88046bc38295721c0c5b16

  • SSDEEP

    49152:MRos/AVhzmQymwq+6r0BCU0hVba2j2O7LIyaXn6k6VjfbtvDGG0U:LIuGq+6r0BL0TM37

Score
10/10
ech0raixlinuxransomware

Malware Config

Targets

    • Target

      2024-03-14_c20200ae3c8acb3aa23a9097b6099739_qnapcrypt

    • Size

      4.7MB

    • MD5

      c20200ae3c8acb3aa23a9097b6099739

    • SHA1

      df920c349a310f6a1532ed05f524f400e85603b3

    • SHA256

      55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567

    • SHA512

      340e157afe4f7b0800009bb220be56dcaffb0b41409935a4730fcfe6f4775960b1aaa0d804d0a0fbcfb47d451cf8c1b2c17cc2211c88046bc38295721c0c5b16

    • SSDEEP

      49152:MRos/AVhzmQymwq+6r0BCU0hVba2j2O7LIyaXn6k6VjfbtvDGG0U:LIuGq+6r0BL0TM37

    Score
    9/10
    ransomware

    • Renames multiple (27194) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes log files

      Deletes log files on the system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    • Reads network interface configuration

      Fetches information about one or more active network interfaces.

    • Write file to user bin folder

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

2
T1574

Privilege Escalation

Hijack Execution Flow

2
T1574

Defense Evasion

Indicator Removal

1
T1070

Hijack Execution Flow

2
T1574

Credential Access

Discovery

System Information Discovery

3
T1082

System Network Configuration Discovery

1
T1016

System Network Connections Discovery

1
T1049

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks