Extracted

• • Target

    functionalities2.PNG

  • Size

    73KB

  • MD5

    d27f7cff4db6458edd548d20c41565a1

  • SHA1

    fda531d527be5f908e82eee0a54b6a03521c5f9d

  • SHA256

    2817c7f5100108bdca6946d1027566de7a128c0e52fee90db9fe67ca2f64981e

  • SHA512

    7cb1984230729445d10ece5fc0dd5dd2f92993de1315261080783ddca0b6d28beaf8d7a4f3406566c4287f5cced7b379aaca23bba755546adafbf6117c926b0b

  • SSDEEP

    1536:qNpoQE2ygvB2zUTqvq3PLxloMfFxtkCeitQxrJ9tRXDo2q:woO/9aMbtkCeFPTDXq

  Score

  10^/10

  blackmatterdarkcometlockbitlinkpdfransomwarerattrojanupx

  • BlackMatter Ransomware

    BlackMatter ransomware group claims to be Darkside and REvil succesor.

    ransomwareblackmatter

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1