Static task
static1
Behavioral task
behavioral1
Sample
2024-05-09_3b4b555b371079bcd0e515864318013c_andromeda_china-chopper_snake_wannacry_wannacryptor.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-09_3b4b555b371079bcd0e515864318013c_andromeda_china-chopper_snake_wannacry_wannacryptor.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-09_3b4b555b371079bcd0e515864318013c_andromeda_china-chopper_snake_wannacry_wannacryptor
-
Size
3.7MB
-
MD5
3b4b555b371079bcd0e515864318013c
-
SHA1
adef55185fc15042355f4b800ead4c0e4335ef82
-
SHA256
99200f68f3ef897a9e45cbeeec23ac975a23c9be7c9768e789e66f902e41e8d7
-
SHA512
bb2053757bf70433e6d60f5034dc56b8c6da57fd441f2ac4d739865cd405462fccf6607fecd46aa54bc8c0abaaadaab3edf33ef687568599edfbd0fd9ceebb07
-
SSDEEP
49152:KNjHaRfldwLkuhoQ1mns/ZRdwLzulL5MK6+:KNmR3QgsBwC5e+
Malware Config
Signatures
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables packed with Dotfuscator 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Dotfuscator -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-09_3b4b555b371079bcd0e515864318013c_andromeda_china-chopper_snake_wannacry_wannacryptor
Files
-
2024-05-09_3b4b555b371079bcd0e515864318013c_andromeda_china-chopper_snake_wannacry_wannacryptor.exe windows:0 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ