Overview

overview

10

Static

static

10

2024-04-20...ya.exe

windows7-x64

10

2024-04-20...ya.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-20_31c8e3744f241a06e6c10507f70105fa_bad-rabbit_doublepulsar_eternalpetya_karagany_notpetya_petrwrap_petya

  • Size

    618KB

  • MD5

    31c8e3744f241a06e6c10507f70105fa

  • SHA1

    78ab7672f6b24ca6f7cf236d0609ab90d252b372

  • SHA256

    6d4eb90e5ccaf6fe5a129ae6b1d84835bfbb500e2028420ff47e63c593b04ebc

  • SHA512

    40e04a5c2d9fa6042e43865aa1de61893a24cc563ca84bf31e5b5a65c58ca3c987513675f50c3d89638240013a787fc1f34f84a387e3e1e8476b29074b312fdd

  • SSDEEP

    12288:Wn/X4NTS/x9jNG+w+9OqFoK323qdQYKU3ZuGOBqs8XIJ25h5pYi:sXATS/x9jNg+95vdQaZAssGlhE

Score
10/10

Malware Config

Signatures

  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-04-20_31c8e3744f241a06e6c10507f70105fa_bad-rabbit_doublepulsar_eternalpetya_karagany_notpetya_petrwrap_petya
    .exe windows:5 windows x86 arch:x86

    ab8fd60b3da01515e6706e8d122c633f


    Headers

    Imports

    Sections