Overview

overview

9

Static

static

3

c4f0ad50a5...2c.exe

windows7-x64

9

c4f0ad50a5...2c.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    VirusShare_9bc495874195fc748591d86cb8b2f720
  • Size 63KB
  • Sample240607-xbbwtsda42
  • SHA256 ad8e686bd21924dfa757f3538b6c1df07944b955f2315b91d6d2298c0c911424
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
defense_evasionexecutionimpactpersistenceransomware

Malware Config

Targets

    • Target
      c4f0ad50a5a82fe65d8ae2f90af1da2c/c4f0ad50a5a82fe65d8ae2f90af1da2c
    • Size 130KB
    • SHA256 f4a4f9aa0ebcf6e7b542b2cad7055aa9220e282ee8dd7fe239e61636a4307dad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasionexecutionimpactpersistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks