4eaeeda72c1352264f13d2ceea4d43306d5f175f0d3c37979f9fb0fd60c553ee

Sharing

Copy URL Twitter E-mail

General

Target
MalwareRepository-main.zip
Size 19.1MB
Sample240512-jtkd2aag78
SHA256 4eaeeda72c1352264f13d2ceea4d43306d5f175f0d3c37979f9fb0fd60c553ee
MD5 daed119c96f26a48b748b7c1c7c25a3e
SHA1 92ca85f945d68222321960dc7091884c41198e3a
SHA512 86c4c7d59b547ec2ce8df614076e9aee70df718369676cfee82dc819ee5dafe1c040263fff2ee8f6915949da0c4a0370c847d0820acdb08466a07f1210d82954
SSDEEP 393216:3QFDO9u/lKPCfXNw2bg0IQa+Ag73G6MBZI6TvPTmmpOK1aLwqCk:3QFO9u/lBNw2bg0TDW66TvyuBoLZ3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  MalwareRepository-main/000.exe
- Size 6.7MB
- SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
- MD5 f2b7074e1543720a9a98fda660e02688
- SHA1 1029492c1a12789d8af78d54adcb921e24b9e5ca
- SHA512 73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff
- SSDEEP 3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

evasion persistence ransomware
- Disables Task Manager via registry modification
  evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1
- Target
  MalwareRepository-main/BattlePong.exe
- Size 194KB
- SHA256 40c0620f6b32da1841fad5def153b9831b9c8aceaf7a41585bfe026d1091d683
- MD5 359b81b7405078e7ced0b96ef8749424
- SHA1 8fac45e81520aa820c816732534e0eff43d9dd24
- SHA512 7e74f9ce6284bdeb983718f09d150883790a27182b322f5f57e01e410ed81987f54b9cc8e938f7d1ec617dc33d959e976263466b4cd648fc0f2dd677d5a9f660
- SSDEEP 3072:34FK+pcwF/70AXAm+7kV5VjIQvcH38Wxp3AnlXn0WCM1cI1hwDCaed:o8TQd5VjR+sWfElX0LC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  MalwareRepository-main/Deathy.exe
- Size 5.2MB
- SHA256 9dfe8b68cc53019040dfccd870b7147365e651b3ff30e378afcc961b6ba800d7
- MD5 9d4e2c467fa1a33d2c95e53935dbdbdc
- SHA1 966da6cc8c86a736dffd53571dbad44092c0588e
- SHA512 5d833c0e2c6c93ab19f569bdede2d71a3b64c87c46f279534387dce0da4fda3795ae99e251ef0b2316975edf11841ca12f88f443102cfeb0d34704ee0d22cfe1
- SSDEEP 98304:8bIzbys7/Coyxnl5tTOT/SOiZbBOgWxkXzT5oXFvx1xq7RB3:85s7/C9nl54/SjcgWxkjT5+FEtB3
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

bootkit evasion persistence ransomware
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral3
- Target
  MalwareRepository-main/InfiniteBlue.exe
- Size 1.8MB
- SHA256 a38f8a7e057e205d3961095a025f5014c0da0567495f2ca5a15f26d89c481026
- MD5 70b9c08114c970f97ba983227e0f08b4
- SHA1 0c3c846828734aed1d74ea47253feef6f81940ac
- SHA512 dc223e4cbfe89a8d92b2042b1c8a0403b26adc7383317cbadc56602d1e9c02a4a80450ec5aa243fdb8ef3a0882a20af48c3ebb7165ca58dfe34c62691c36f5eb
- SSDEEP 49152:RqrObhdGZu/xJrtcaXxfjDSVQEWnu3+w3JJn+:oExvFXpCQG3+OXn+
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

bootkit discovery evasion persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies file permissions
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral4
- Target
  MalwareRepository-main/LogonFuck.exe
- Size 8.1MB
- SHA256 78a7a05316929dddcba6788429eeec08b5428590b89b8d272bd79471f0b6a4d8
- MD5 7ee3aeb93b0fa8dc34893e8b3c0f5510
- SHA1 faedf76ced4d16de8832d084be985ed8b32cf20d
- SHA512 fba2326c80a69841fa9c97198aa69b0b019fffa591a5f7bd8b38da99f8eb8baa0662c8a4dc751ec38dc7892097175f3b760a7d7e1116aaeeb4b2ffe04b821d29
- SSDEEP 196608:WIAlVbD80eclAADocTlPP6H442TXmN1baBwPWQySi6dFNq:FaD80ecaAsqVjlXm7bR+Q95d
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery evasion
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral5
- Target
  MEMZ 4.0 Clean/MEMZ-Clean.bat
- Size 9KB
- SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
- MD5 bbae81b88416d8fba76dd3145a831d19
- SHA1 42fa0e1b90ad49f66d4ab96c8cca02f81248da8b
- SHA512 f03ac63bbb504cb53dc896c2bec8666257034b1c4a5827a4ad75c434af05f1cd631a814cc8689e60210e4ca757e61390db8d222f05bf9f3a0fa7026bdf8c4368
- SSDEEP 192:XBOTDzoOgdlf7MAdTyQuHq2b1vXei2SLca5icrLJlz3:ss/tDyQuHZddL5Jlz3
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

execution
- Executes dropped EXE
behavioral6
- Target
  MEMZ 4.0 Clean/MEMZ-Clean.exe
- Size 12KB
- SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
- MD5 9c642c5b111ee85a6bccffc7af896a51
- SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
- SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
- SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  MalwareRepository-main/MEMZTrojan.exe
- Size 12KB
- SHA256 3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
- MD5 a7bcf7ea8e9f3f36ebfb85b823e39d91
- SHA1 761168201520c199dba68add3a607922d8d4a86e
- SHA512 89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
- SSDEEP 192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral8
- Target
  MalwareRepository-main/NRansom.exe
- Size 1.2MB
- SHA256 c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5
- MD5 9a60890fc062d10d826c31d049706ab7
- SHA1 3ae8d97461fb08c4327431c0589322e3cbb1e3de
- SHA512 03de8351ab6ab1e46c4f1792f4caeeaaee4b8a18b407839c1697890032aa813cae9174e1a27cb582ef5286be0b47d23966a71e0b740feb6b1814137b779fcdcc
- SSDEEP 24576:DDSANUv0/NUvKLpkr2dY/aBcjJOBHOBIQBajMtWvoJiLE1+XgRKz89G/4ZSb0FuH:T80/8KLpkr2dY/aBcjJOBHOBIQBajMtA
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  MalwareRepository-main/NoEscape.exe
- Size 666KB
- SHA256 d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
- MD5 989ae3d195203b323aa2b3adf04e9833
- SHA1 31a45521bc672abcf64e50284ca5d4e6b3687dc8
- SHA512 e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
- SSDEEP 12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Modifies WinLogon
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral10
- Target
  MalwareRepository-main/Petya.exe
- Size 225KB
- SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
- MD5 af2379cc4d607a45ac44d62135fb7015
- SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
- SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
- SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral11
- Target
  libcrypto-1_1.dll
- Size 2.0MB
- SHA256 81e7e8206cf46c7aa3abb69a2a2dac8371bf5eea137df1901a84a5b7388fe768
- MD5 6f52970d7a41141d3c93b3937bd6b84c
- SHA1 bd94dcb31ff9e64b187af8f2361ec688bf5bb91d
- SHA512 71b8da11ddb181a1864ca83e4a2d9a5e13948c372d7ea2d4fb5bb5e0acf957c039bd5456ad16c08dd2e18ef252ee492b01c84ecf748afdb616d5496faeca4437
- SSDEEP 49152:T6kvSjcvQ/qpyr0kou74WAdvHoU6U1CPwDv3uFV0cSWPWb:2kvCcvQ/qpyr0koW6oUh1CPwDv3uFV0
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral12
- Target
  msvcr120.dll
- Size 948KB
- SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
- MD5 034ccadc1c073e4216e9466b720f9849
- SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
- SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
- SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13
- Target
  petya_key.exe
- Size 76KB
- SHA256 368dff8cfb0f54941d5ebcdc41148f01d14137f8c7aade1a3c94824ecb9535ac
- MD5 7d301ba376944a3e2ca31d4364a5a876
- SHA1 7c1b6dbe3de9c6495ee9524db78524b035996f69
- SHA512 274241590919749bc739c4b101b05c0c0d5becd058cbf8350afffcf2369a5eefc4078ac144e3ed8b6676a710cd53b17496d29b729ae7235bef27dbf8f6cadc54
- SSDEEP 768:5gQU49CEBHSNrpqOQ5JHQZurQ6MAPxLBdzMd3xTrdDbYJcE4+zTmyQCzg28zlhqx:O9WBxQZ5sxFGN+sP/+SrU/ljcGwPc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  MalwareRepository-main/Spark.exe
- Size 495KB
- SHA256 55bfcb784904477ef62ef7e4994dee42f03d69bfec3591989513cccbba3fc8fe
- MD5 181ee63003e5c3ec8c378030286ed7a2
- SHA1 6707f3a0906ab6d201edc5b6389f9e66e345f174
- SHA512 e9820f60b496d6631e054204c6fc5b525527d40a578faac1d5cdb116abcb4a35aacf4f4354ff092a2b455c5d9c2e0f29a761d737d9c9ad3d59d70b51d0583d92
- SSDEEP 12288:ehny10sOqEl5yD4UmxYV1g1bT2kdSOSGL84Umxb:exZ5vYORMOJ/b
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

evasion ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
behavioral15
- Target
  MalwareRepository-main/TrollInfiniteBlue.exe
- Size 288KB
- SHA256 e5a872454cd6792202e10966edc9568db1032e41a2fd268d60a42a1ed547fd0b
- MD5 b20880c0ec4d881a124673b5c30ba9fd
- SHA1 626b52a9769843228c5a452d3b6fdaa6801b2d7c
- SHA512 7a9e801dd01fd2450e0e2b74d2eea287c3097ffb0709636e9c3474e2df1e0d0e76ff4ca37c2558af5a95ff64ceaec43aa88b50c82e652d2649138b78b27c1d34
- SSDEEP 6144:vjT5Zh17eWxoG/+ov/2OIQ4wW3OBsZeEWuYFvb1k:vRZ+IoG/n9IQxW3OBszqvb1k
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral16
- Target
  MalwareRepository-main/nepotonod.exe
- Size 831KB
- SHA256 e75a807501916dbbffdba65e938588de4e8dc51b8af90cab107260c6684873c2
- MD5 5dd681fa32db64f6119423afb4dfb6fd
- SHA1 bcf07b390a3a946e27fad14aecf0be2f26d328ff
- SHA512 668ece14aaffc562e0ff132633dc5cc43e88ef6b3ee165a96e6053e9aa35d8bbd413818c7264661715bf5a7262d3173e189a89a7f67f883b550539806780f9fe
- SSDEEP 24576:AjW20SaqJo9TL5tj112jGLF2eoRdDyLI3QABV3FMD5i/UnvF+vg:BSAL5tj112jGLF2eoRdDyLI3QABc5i/i
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence ransomware
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral17
- Target
  MalwareRepository-main/quantizer.exe
- Size 212KB
- SHA256 68d528f9ac891e920449188198a233b71b2860838af4fb970b9966f941ce82ca
- MD5 1458480cf8803569195f934d47ac7481
- SHA1 e82b5cbf643075a44049aa97ba045795da25ab55
- SHA512 168466da32f952df6bae568e75bb683bc6e009880b67d28acc0f3b8fb6e88b186abbeeabf0a87bf9a01f47362c157f46277682d9a3e2bdab90f8f2f2775f7e04
- SSDEEP 1536:Ra2jqHhCCjLFUkH8neWP4xqunYlFjTZgjq9qlQJ1veZ2eDg4X:RLjqHhCWcn5BYYfjTZgjq9BT2Z2eDP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18