Overview

overview

9

Static

static

3

fff1c83e4f...db.exe

windows7-x64

9

fff1c83e4f...db.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb

  • Size

    142KB

  • Sample

    240425-gc27eagb85

  • MD5

    64ba02bec137e708106752707b8e2876

  • SHA1

    d282b42d9c410816ac2c4feea9166d5c532e65ee

  • SHA256

    fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb

  • SHA512

    eb86452c8ef95e376ec5ca58a999d5efc47d776414a4251e2d3bb4d34138d53c4c64f3dd4aeb1342832a00842c4e979e25198e2dd79a684bf6289607e147fa38

  • SSDEEP

    3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZVe7WpMaxeb0CYJ97lEYNR73e+eKZw:RqKvb0CYJ973e+eKZQqKvb0CYJ973e+2

Score
9/10
ransomware

Malware Config

Targets

    • Target

      fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb

    • Size

      142KB

    • MD5

      64ba02bec137e708106752707b8e2876

    • SHA1

      d282b42d9c410816ac2c4feea9166d5c532e65ee

    • SHA256

      fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb

    • SHA512

      eb86452c8ef95e376ec5ca58a999d5efc47d776414a4251e2d3bb4d34138d53c4c64f3dd4aeb1342832a00842c4e979e25198e2dd79a684bf6289607e147fa38

    • SSDEEP

      3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZVe7WpMaxeb0CYJ97lEYNR73e+eKZw:RqKvb0CYJ973e+eKZQqKvb0CYJ973e+2

    Score
    9/10
    ransomware

    • Renames multiple (4117) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks