2024-04-28_a24eef7a9d9a41694a196c9a340fa436_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-28_a24eef7a9d9a41694a196c9a340fa436_bkransomware
Size

159KB
MD5

a24eef7a9d9a41694a196c9a340fa436
SHA1

e710f33b42c17862db95a23c260ee5a223c9840e
SHA256

eb151a4e9f1ffabe0bbe820bc2ccc1acf8ce32189557bc18ac6b3ff22bfaccd6
SHA512

f84b68c37903a25e74ddc29f2ee52ed95b225ab9f199488a36041c6cef414649a53bf3fd43f21676116c0e65c9e6ed6ef91e8d6deb81818a4af38266efc5dfc3
SSDEEP

3072:1eBLq0k5PWpewxNCGDQAEElXXpk3xHc2hXqsnyrl:190M+BxbEENXiVqskl

Score

1^/10

Malware Config

Signatures

Files

2024-04-28_a24eef7a9d9a41694a196c9a340fa436_bkransomware
.exe windows:5 windows x86 arch:x86

1846ecc03770728f06417b1171777c31

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1c:68:3f:7b:8f:fb:cd:ac:e1:92:7d:58:8d:49:06:cf
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09/09/2015, 00:00

Not After

07/11/2018, 23:59

Subject

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bc:49:a0:e8:c6:f2:b3:59:22:7a:ab:47:ea:b0:c7:e9:e9:4c:cd:9e
Signer

Actual PE Digest

bc:49:a0:e8:c6:f2:b3:59:22:7a:ab:47:ea:b0:c7:e9:e9:4c:cd:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

RA_SFTP.pdb

Imports

ws2_32

WSACleanup
WSAStartup
socket
shutdown
send
select
recv
connect
closesocket
__WSAFDIsSet
setsockopt
getsockopt
ioctlsocket
WSAGetLastError
WSASetLastError
getservbyname
getservbyport
gethostbyname
gethostbyaddr
ntohs
ntohl
inet_ntoa
inet_addr
htons
htonl

kernel32

DeleteFileW
SetEnvironmentVariableA
HeapSize
OutputDebugStringW
GetCurrentDirectoryW
GetFullPathNameW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
WriteConsoleW
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetLastError
GetFileSize
WriteFile
GetFileAttributesExW
SetFilePointer
FindClose
SetFileTime
lstrcmpA
lstrcpynA
lstrcpyA
lstrlenA
GetCurrentDirectoryA
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetFileAttributesA
FindFirstFileA
GetVolumeInformationA
GetExitCodeProcess
CreateThread
SetLastError
ResumeThread
SetEvent
WaitForSingleObject
WaitForMultipleObjects
CloseHandle
CreateEventA
FormatMessageA
ExpandEnvironmentStringsA
GetCurrentProcessId
lstrcmpiA
GetLogicalDrives
GetDriveTypeA
FindNextFileA
SetFileAttributesW
CreateDirectoryW
SetEndOfFile
SetConsoleCtrlHandler
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
SetStdHandle
GetFileType
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RemoveDirectoryW
HeapAlloc
RtlUnwind
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
FileTimeToSystemTime
FlushFileBuffers
ReadFile
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetFilePointerEx
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetStdHandle
DeleteCriticalSection
CreateFileW
GetModuleFileNameW
LoadLibraryExW
GetTimeZoneInformation
MoveFileExW

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1846ecc03770728f06417b1171777c31

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

1c:68:3f:7b:8f:fb:cd:ac:e1:92:7d:58:8d:49:06:cfCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

bc:49:a0:e8:c6:f2:b3:59:22:7a:ab:47:ea:b0:c7:e9:e9:4c:cd:9eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

advapi32

Sections

.text Size: 111KB - Virtual size: 110KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 5KB - Virtual size: 28KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

1c:68:3f:7b:8f:fb:cd:ac:e1:92:7d:58:8d:49:06:cf
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

bc:49:a0:e8:c6:f2:b3:59:22:7a:ab:47:ea:b0:c7:e9:e9:4c:cd:9e
Signer

.text
Size: 111KB - Virtual size: 110KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 5KB - Virtual size: 28KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB