Overview

overview

9

Static

static

1

2024-06-10...if.exe

windows7-x64

9

2024-06-10...if.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-06-10_96669ed55032d1b7561e4c35aa39aee9_bkransomware_floxif

  • Size

    2.1MB

  • Sample

    240610-pvrgmawdkl

  • MD5

    96669ed55032d1b7561e4c35aa39aee9

  • SHA1

    695e2e2332cfd9cbb459d192b072a5070920db22

  • SHA256

    39ba7a38c2b1d26dcfc62ab3eaa087146f5f668aeb87836423512b49b7b9158e

  • SHA512

    4a22840c9347ca595b05a87b5fdc733144117a72523947fb11b9030668834446b08fd7db14883efe3c35ea58097488cdbc7f550a6f5d2c59bb95c5ae0e07a48f

  • SSDEEP

    49152:/ofqq2msxBMWSARio/D4aQGJ6+Y59N2153nqPk4utu+NNAVw6rPY4:gCq2R3MWSAN/M9GJrYx2r3qPk4utCV1

Score
9/10
persistenceupx

Malware Config

Targets

    • Target

      2024-06-10_96669ed55032d1b7561e4c35aa39aee9_bkransomware_floxif

    • Size

      2.1MB

    • MD5

      96669ed55032d1b7561e4c35aa39aee9

    • SHA1

      695e2e2332cfd9cbb459d192b072a5070920db22

    • SHA256

      39ba7a38c2b1d26dcfc62ab3eaa087146f5f668aeb87836423512b49b7b9158e

    • SHA512

      4a22840c9347ca595b05a87b5fdc733144117a72523947fb11b9030668834446b08fd7db14883efe3c35ea58097488cdbc7f550a6f5d2c59bb95c5ae0e07a48f

    • SSDEEP

      49152:/ofqq2msxBMWSARio/D4aQGJ6+Y59N2153nqPk4utu+NNAVw6rPY4:gCq2R3MWSAN/M9GJrYx2r3qPk4utCV1

    Score
    9/10
    persistenceupx

    • UPX dump on OEP (original entry point)

    • Modifies AppInit DLL entries

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks