Overview

overview

10

Static

static

10

0626832573...e1.exe

windows7-x64

9

0626832573...e1.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1.zip

  • Size

    104KB

  • Sample

    240426-ayv7nage54

  • MD5

    ed0a21dbc3117703115ee099fd8490dd

  • SHA1

    fb25152df18e538e6d470fee40f414f95be25cba

  • SHA256

    e8e6c73eaa3f94a1b5c82b97e38eabf0de9805a803a88d40076d72783b5e412f

  • SHA512

    27792069f39df4ec807d3171f4fa1392c2908dbd3c4f45115af10ecdd3fe2ba7fb94effcefb95a0cb3bc31dd5355897bb4411630e5756c73b7d8d52f753625d6

  • SSDEEP

    1536:gKFunWE7o5MEVsjcfu80qJqB+Q1RJDc0aBWvPqA7k68cnURJ32zAWUXHc2tkLHTn:so57swF1I+mo0iAohqURZeARH/uEc

Score
10/10
lockbitransomwarespywarestealer

Malware Config

Targets

    • Target

      062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1.exe

    • Size

      194KB

    • MD5

      50e5dec57451005668704281688ca55d

    • SHA1

      67dd4ac7eb8c193b39149b34d3a0d5bc21c3f200

    • SHA256

      062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1

    • SHA512

      29ca4a44795c71d3e2b4e3417355ebb93765157d464d6d5a3fe6774056d934d57081c72001fb29e47982da11e5a5ccfdbcc958d05a11fb49bd8bf84e6d0c61ad

    • SSDEEP

      3072:66glyuxE4GsUPnliByocWepRGbVZqid91h2ys+tU:66gDBGpvEByocWeubV4inP9B

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (319) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks