Overview

overview

10

Static

static

10

VirusShare...1d.exe

windows7-x64

9

VirusShare...1d.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VirusShare_1c18a0f35e1eb39e130eeeb12163701d

  • Size

    12KB

  • Sample

    240610-z1pkbs1crp

  • MD5

    1c18a0f35e1eb39e130eeeb12163701d

  • SHA1

    05efb81dcd92695cec510f6e80c81b4ec7e5b42e

  • SHA256

    a30c0eeba490a6855df6aadee5d546cedc0e410752163573d95b0114c9185107

  • SHA512

    776cf8f5848f47bee24d294e648b376d0e304a963fb332cc59c9a6eccfa57770a8e2a23055117e523933c1ae5076e31b49c11f12cac31be4278cc4803968de0e

  • SSDEEP

    192:1/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMF50n0FI3P:1ebFNw4Pk1itKkpAjjI2YpdmFw0FIf

Score
10/10
xoristpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      VirusShare_1c18a0f35e1eb39e130eeeb12163701d

    • Size

      12KB

    • MD5

      1c18a0f35e1eb39e130eeeb12163701d

    • SHA1

      05efb81dcd92695cec510f6e80c81b4ec7e5b42e

    • SHA256

      a30c0eeba490a6855df6aadee5d546cedc0e410752163573d95b0114c9185107

    • SHA512

      776cf8f5848f47bee24d294e648b376d0e304a963fb332cc59c9a6eccfa57770a8e2a23055117e523933c1ae5076e31b49c11f12cac31be4278cc4803968de0e

    • SSDEEP

      192:1/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMF50n0FI3P:1ebFNw4Pk1itKkpAjjI2YpdmFw0FIf

    Score
    9/10
    persistenceransomwarespywarestealer

    • Renames multiple (2184) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks