cryptolocker

General

Target

sample
Size

169KB
Sample

240611-jv697azcmh
MD5

a957582bd5371c69795bd1c2ee73a042
SHA1

d725b7f30bbb1eda943cf992a23db6d36a4be505
SHA256

07b224d0aee012bdfedea8fb860f93d091fb4c1a2d6d581e7620570fa2a4e3fd
SHA512

334244a1a6fae10a779c1b66a74da2263e77a3beaa8075e82254331992fdc68bd54fc5167d07d4b9015f71e198b701f66bdcf24bf8c271c282070836d7d450c3
SSDEEP

3072:PagocDBgWgjiiiyR22pwTEGuCisou6U2ekT+twq+k+twq2k+twqhk4twqck+twql:P/BEGuCisou6U2ekT+twq+k+twq2k+tu

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://93.115.82.248/?0=1&1=1&2=9&3=i&4=9200&5=1&6=1111&7=piaatcpisj

Extracted

Family

danabot

C2

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Targets

- Target
  
  sample
- Size
  
  169KB
- MD5
  
  a957582bd5371c69795bd1c2ee73a042
- SHA1
  
  d725b7f30bbb1eda943cf992a23db6d36a4be505
- SHA256
  
  07b224d0aee012bdfedea8fb860f93d091fb4c1a2d6d581e7620570fa2a4e3fd
- SHA512
  
  334244a1a6fae10a779c1b66a74da2263e77a3beaa8075e82254331992fdc68bd54fc5167d07d4b9015f71e198b701f66bdcf24bf8c271c282070836d7d450c3
- SSDEEP
  
  3072:PagocDBgWgjiiiyR22pwTEGuCisou6U2ekT+twq+k+twq2k+twqhk4twqck+twql:P/BEGuCisou6U2ekT+twq+k+twq2k+tu
Score

10^/10

cryptolocker danabot banker discovery evasion execution persistence ransomware spyware stealer trojan
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Blocklisted process makes network request
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1