General

  • Target

    2024-05-25_2c2aabd374c4a8b5d266160f29645e58_virlock

  • Size

    634KB

  • Sample

    240525-qmjx9adh9v

  • MD5

    2c2aabd374c4a8b5d266160f29645e58

  • SHA1

    3e08e026ec02d3d8986bae60cf9b13490a076cfe

  • SHA256

    2480333ca4d969ca117e9aae182ac7ace3afcd2172719b6b295252adce357558

  • SHA512

    b80bf68f8836b0d41a8fcd4b82094097cf11061ee4b5b8f824e313d385750a4a8c814056a9e338a08fb9341fb49f6d1076ab542ef8a5608e8de87a57f87cee88

  • SSDEEP

    12288:i8T8hPMbdr4oWhEgpnRGImUI8w/Y8OcZkPyIEgjiD:iRPMbZSNnR478w/Yn4g+

Malware Config

Targets

    • Target

      2024-05-25_2c2aabd374c4a8b5d266160f29645e58_virlock

    • Size

      634KB

    • MD5

      2c2aabd374c4a8b5d266160f29645e58

    • SHA1

      3e08e026ec02d3d8986bae60cf9b13490a076cfe

    • SHA256

      2480333ca4d969ca117e9aae182ac7ace3afcd2172719b6b295252adce357558

    • SHA512

      b80bf68f8836b0d41a8fcd4b82094097cf11061ee4b5b8f824e313d385750a4a8c814056a9e338a08fb9341fb49f6d1076ab542ef8a5608e8de87a57f87cee88

    • SSDEEP

      12288:i8T8hPMbdr4oWhEgpnRGImUI8w/Y8OcZkPyIEgjiD:iRPMbZSNnR478w/Yn4g+

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Renames multiple (73) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks