2024-06-16_dc13a6e1633a19822451ca8d7669186d_bkransomware_karagany

General

Target
2024-06-16_dc13a6e1633a19822451ca8d7669186d_bkransomware_karagany
Size 1.8MB
Sample240616-wej6ya1apd
SHA256 369c9e5b131132059e298b9b7d4110e1d88526211f5ddda97ced4dd323eca037
MD5 dc13a6e1633a19822451ca8d7669186d
SHA1 6503afcc303380358d480d9b664e921d1a1d46cc
SHA512 de454523ddfb8a3a3c52b192f6fb2c27c1f8b8d63de2d9217780d68dd2030d917e4f84009ec179eaa330d6891bb8ca26b06294bec68d5a4df46bd9a50278ec1e
SSDEEP 49152:X9AdoX4s6K70P4cNuFidXCoBJneGUe6tQPKiJc:tAans4cNdNBJnes6tQPx
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-16_dc13a6e1633a19822451ca8d7669186d_bkransomware_karagany

.exe 1.8MB

2024-06-16_dc13a6e1633a19822451ca8d7669186d_bkransomware_karagany

IMPHASH 953d06d022913b2f3177ca6a1c61cb05
SHA256 369c9e5b131132059e298b9b7d4110e1d88526211f5ddda97ced4dd323eca037
MD5 dc13a6e1633a19822451ca8d7669186d
SHA1 6503afcc303380358d480d9b664e921d1a1d46cc
SHA512 de454523ddfb8a3a3c52b192f6fb2c27c1f8b8d63de2d9217780d68dd2030d917e4f84009ec179eaa330d6891bb8ca26b06294bec68d5a4df46bd9a50278ec1e
SSDEEP 49152:X9AdoX4s6K70P4cNuFidXCoBJneGUe6tQPKiJc:tAans4cNdNBJnes6tQPx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

0a:bc:03:1e:21:27:47:6c:15:ef:bd:92:82:96:69:e6:a7:db:36:20:97:a2:43:d4:8a:2d:3b:e6:f1:5a:95:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

Chains

Jun 12, 2024

Minor OS version

1

Major OS version

5

Entry point

16688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\build.tc\bishorn\work\da61b1900aa695f2\-\-\-\rescue\Applet\native\bin\x86\LMIRescue.pdb

kernel32

Sleep lstrcatA CreateDirectoryA SetCurrentDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA FindClose LoadLibraryA FindNextFileA GetModuleHandleA GetTempPathA DeleteFileA lstrcpyA CreateFileA FindResourceA SetFilePointer FreeResource GetWindowsDirectoryA FormatMessageA WriteFile SizeofResource GetFileAttributesA CreateProcessA SetLastError CopyFileA LockResource GetModuleFileNameA CloseHandle GetCurrentDirectoryA HeapAlloc HeapFree GetProcessHeap WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetCurrentProcess FreeLibrary lstrcpynA lstrlenA LoadResource lstrcmpA IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle GetModuleFileNameW LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW OutputDebugStringW HeapSize HeapReAlloc LCMapStringW RtlUnwind GetStringTypeW FlushFileBuffers GetConsoleCP CreateFileW

user32

wvsprintfA wsprintfA MessageBoxA

advapi32

RegEnumValueA RegQueryInfoKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-16_dc13a6e1633a19822451ca8d7669186d_bkransomware_karagany

PE Signature issue

kernel32

user32

advapi32

generic