Overview

overview

9

Static

static

3

ransom.exe

windows10-1703-x64

9

Resubmissions

09/06/2024, 14:57

240609-sbqb1acd769

09/06/2024, 14:54

240609-r9vtpscd639

Sharing

Copy URL Twitter E-mail

General

  • Target
    ransom.exe
  • Size 9.6MB
  • Sample240609-r9vtpscd63
  • SHA256 7a9d65371caadae24c4890655a13de8b452d2a85cac57916e6000576ac5f9f80
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionexecutionpersistencepyinstallerransomwarespyware

Malware Config

Targets

    • Target
      ransom.exe
    • Size 9.6MB
    • SHA256 7a9d65371caadae24c4890655a13de8b452d2a85cac57916e6000576ac5f9f80
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    evasionexecutionpersistenceransomwarespyware

    • Renames multiple (157) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks