Overview

overview

10

Static

static

10

cfbcf82790...91.exe

windows7-x64

1

cfbcf82790...91.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cfbcf827900a5dc36d1d2ba4b4879ce703a429b1952e6e9616f498a9bde68c91.exe

  • Size

    2.3MB

  • MD5

    68d90c681c9748e8489f3f9fc622301d

  • SHA1

    931ebcaec96692ba2054379a489a4af0451bf630

  • SHA256

    cfbcf827900a5dc36d1d2ba4b4879ce703a429b1952e6e9616f498a9bde68c91

  • SHA512

    4dcd84246dec0522787dff8fb1ff90e418e1ed47496f9e35e56e5c5c26dcc8a2283a0478bcbd44d61a763ea46b050675aca1d93a6ff628d39f7f51e254fbdd80

  • SSDEEP

    49152:ethZYkcxB6Zx2dMWmNfcdFanp+tPVJ7A4wsWKQKNZpOcua04w44:ethZYZxoXiYFcdip+XJiK/xu

Score
10/10
mimic

Malware Config

Signatures

  • Detects Mimic ransomware 1 IoCs
  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 1 IoCs
  • Mimic family
    mimic
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cfbcf827900a5dc36d1d2ba4b4879ce703a429b1952e6e9616f498a9bde68c91.exe
    .exe windows:6 windows x86 arch:x86

    430e92222641741f296d1e98a8abfeab


    Headers

    Imports

    Sections