Static task
static1
Behavioral task
behavioral1
Sample
2024-05-09_08c803ba24c29b56bca1491c4b93d9d6_andromeda_china-chopper_snake_wannacry_wannacryptor.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-09_08c803ba24c29b56bca1491c4b93d9d6_andromeda_china-chopper_snake_wannacry_wannacryptor.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-09_08c803ba24c29b56bca1491c4b93d9d6_andromeda_china-chopper_snake_wannacry_wannacryptor
-
Size
4.0MB
-
MD5
08c803ba24c29b56bca1491c4b93d9d6
-
SHA1
818b348c3ab14f011c1aa3afabf6b5257cc48680
-
SHA256
47b4f6cab9153b94fc61acdb9857fdfbf3d400f4187ceb8ce49ee46ce3fe8816
-
SHA512
4784457984e257872baf8b2e03160504eae869ab2c9dd212433a7e8ad7716b9a970404f9d04915239723b855efd3d84a3b4655a8ab5c9377b1b7d65e414e6196
-
SSDEEP
49152:cNaHAWgldwoZuh5k1m7s/4MR4HezZe5iP63:cN9WFkEs54z5t3
Malware Config
Signatures
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables packed with Dotfuscator 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Dotfuscator -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-09_08c803ba24c29b56bca1491c4b93d9d6_andromeda_china-chopper_snake_wannacry_wannacryptor
Files
-
2024-05-09_08c803ba24c29b56bca1491c4b93d9d6_andromeda_china-chopper_snake_wannacry_wannacryptor.exe windows:0 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ