Behavioral task
behavioral1
Sample
2024-03-18_7c06c24a85d22be1e6880a58d9c4d079_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-18_7c06c24a85d22be1e6880a58d9c4d079_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-18_7c06c24a85d22be1e6880a58d9c4d079_cryptolocker
-
Size
149KB
-
MD5
7c06c24a85d22be1e6880a58d9c4d079
-
SHA1
97b80bb636e7c91a49b136cee88f6edd43f1a1b5
-
SHA256
e49d8384b8a165550767a08a615fd507b266dc4db1383275a65037dcb064dc94
-
SHA512
cdb0156e0c1703643ee428fd8fd5d76db48f7def1166e4bc9b7dd239eca5fee539b41cb4de9b1f053261bfa258ae7aa403592006171507bacecc86a2cd5dc12c
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp699GNtL1e2X:z6a+CdOOtEvwDpjczo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule sample CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule sample CryptoLocker_set1 -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-18_7c06c24a85d22be1e6880a58d9c4d079_cryptolocker
Files
-
2024-03-18_7c06c24a85d22be1e6880a58d9c4d079_cryptolocker.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 20KB - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE