Overview

overview

9

Static

static

1

2024-05-14...ny.exe

windows7-x64

9

2024-05-14...ny.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-14_0b586a585e6ebf398bfe44cc815682e7_bkransomware_floxif_karagany

  • Size

    1.3MB

  • Sample

    240514-mfpclsbg4t

  • MD5

    0b586a585e6ebf398bfe44cc815682e7

  • SHA1

    d88665f17562ad5210e45efd7dbeafe0675357d6

  • SHA256

    703ba85222678b0eee044702c37f13006ddfb1212dccbbc1b461dd83fec783d0

  • SHA512

    57af9cb7d48b9a29604a04fa9cef5c8aa3e81828e0c3481ae88c4eb1893cf0a073ec5c9bd27e484b2281fcb3e4f83fb8220a36ddaa4fada79c85fcdf29c539c5

  • SSDEEP

    12288:ehDjI4Ac2W6RK2tAJBuFyGbwDi3VO1WRBjvrEH77:COcCK2OBuFyjDi3M8rEH77

Score
9/10
persistenceupx

Malware Config

Targets

    • Target

      2024-05-14_0b586a585e6ebf398bfe44cc815682e7_bkransomware_floxif_karagany

    • Size

      1.3MB

    • MD5

      0b586a585e6ebf398bfe44cc815682e7

    • SHA1

      d88665f17562ad5210e45efd7dbeafe0675357d6

    • SHA256

      703ba85222678b0eee044702c37f13006ddfb1212dccbbc1b461dd83fec783d0

    • SHA512

      57af9cb7d48b9a29604a04fa9cef5c8aa3e81828e0c3481ae88c4eb1893cf0a073ec5c9bd27e484b2281fcb3e4f83fb8220a36ddaa4fada79c85fcdf29c539c5

    • SSDEEP

      12288:ehDjI4Ac2W6RK2tAJBuFyGbwDi3VO1WRBjvrEH77:COcCK2OBuFyjDi3M8rEH77

    Score
    9/10
    persistenceupx

    • UPX dump on OEP (original entry point)

    • Modifies AppInit DLL entries

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks