azov

Resubmissions

05/02/2025, 08:57

250205-kwyvwayrgv10

13/07/2024, 09:29

240713-lf7nhsvgrp10

Sharing

Copy URL Twitter E-mail

General

Target
002.7z
Size 11.2MB
Sample240713-lf7nhsvgrp
SHA256 cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278
MD5 82180da2d9ecde4947a618ff1a37fdad
SHA1 ae327ea9229498e86afb337b87cf6d6f4caaa309
SHA512 606ddfb833eb38952403ae10e9eec694d45e3fb2df326d5825f93257d605552868343e80fd6e3a497d690dabe8ed1493b60843118f1aa5412be8cc55a66335a3
SSDEEP 196608:nYcNyJpHBLBc6gKWYZzbK26sqaddXpgPxydfcNQChzHayMxpJ51LipiFe5TZD0B:n5yJ1pB+KWYtbK26sq25GyxcR6yMt51L
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path

C:\Users\ooxlOmJxX.README.txt

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest and most stable ransomware from 2019~~~ >>>>> Your data is stolen and encrypted. If you don't pay the ransom, the data will be published on our TOR darknet sites. Keep in mind that once your data appears on our leak site, it could be bought by your competitors at any second, so don't hesitate for a long time. The sooner you pay the ransom, the sooner your company will be safe. Tor Browser Links: http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion Links for normal browser: http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly >>>>> What guarantee is there that we won't cheat you? We are the oldest ransomware affiliate program on the planet, nothing is more important than our reputation. We are not a politically motivated group and we want nothing more than money. If you pay, we will provide you with decryption software and destroy the stolen data. After you pay the ransom, you will quickly make even more money. Treat this situation simply as a paid training for your system administrators, because it is due to your corporate network not being properly configured that we were able to attack you. Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and pay for it. If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future. You can get more information about us on Ilon Musk's Twitter https://twitter.com/hashtag/lockbit?f=live >>>>> You need to contact us and decrypt one file for free on TOR darknet sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from you. If you need a unique ID for correspondence with us that no one will know about, tell it in the chat, we will generate a secret chat for you and give you his ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser personal link available only to you (available during a ddos attack): http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion Tor Browser Links for chat (sometimes unavailable due to ddos attacks): http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal ID: B51C595D54036891C97A343D13B59749 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They won't help and will only make things worse for you. In 3 years not a single member of our group has been caught by the police, we are top notch hackers and we never leave a trail of crime. The police will try to prohibit you from paying the ransom in any way. The first thing they will tell you is that there is no guarantee to decrypt your files and remove stolen files, this is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it is a matter of our reputation, we make hundreds of millions of dollars and are not going to lose our revenue because of your files. It is very beneficial for the police and FBI to let everyone on the planet know about your data leak because then your state will get the fines budgeted for you due to GDPR and other similar laws. The fines will be used to fund the police and the FBI, they will eat more sweet coffee donuts and get fatter and fatter. The police and the FBI don't care what losses you suffer as a result of our attack, and we will help you get rid of all your problems for a modest sum of money. Along with this you should know that it is not necessarily your company that has to pay the ransom and not necessarily from your bank account, it can be done by an unidentified person, such as any philanthropist who loves your company, for example, Elon Musk, so the police will not do anything to you if someone pays the ransom for you. If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom. The police and FBI will not be able to stop lawsuits from your customers for leaking personal and private information. The police and FBI will not protect you from repeated attacks. Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees. >>>>> What are the dangers of leaking your company's data. First of all, you will receive fines from the government such as the GDRP and many others, you can be sued by customers of your firm for leaking information that was confidential. Your leaked data will be used by all the hackers on the planet for various unpleasant things. For example, social engineering, your employees' personal data can be used to re-infiltrate your company. Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. On another vacation trip, you will have to explain to the FBI where you got millions of dollars worth of stolen cryptocurrency transferred through your accounts on cryptocurrency exchanges. Your personal information could be used to make loans or buy appliances. You would later have to prove in court that it wasn't you who took out the loan and pay off someone else's loan. Your competitors may use the stolen information to steal technology or to improve their processes, your working methods, suppliers, investors, sponsors, employees, it will all be in the public domain. You won't be happy if your competitors lure your employees to other firms offering better wages, will you? Your competitors will use your information against you. For example, look for tax violations in the financial documents or any other violations, so you have to close your firm. According to statistics, two thirds of small and medium-sized companies close within half a year after a data breach. You will have to find and fix the vulnerabilities in your network, work with the customers affected by data leaks. All of these are very costly procedures that can exceed the cost of a ransomware buyout by a factor of hundreds. It's much easier, cheaper and faster to pay us the ransom. Well and most importantly, you will suffer a reputational loss, you have been building your company for many years, and now your reputation will be destroyed. Read more about the GDRP legislation:: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr.eu/what-is-gdpr/ https://gdpr-info.eu/ >>>>> Don't go to recovery companies, they are essentially just middlemen who will make money off you and cheat you. We are well aware of cases where recovery companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us directly without intermediaries you would pay 5 times less, that is 1 million dollars. >>>> Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction. >>>>> If you do not pay the ransom, we will attack your company again in the future.

URLs

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/

Extracted

Path

C:\Users\How To Restore Your Files.txt

darkside

Ransom Note

----------- [ Hello! ] -------------> ****BY BABUK LOCKER**** What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. How to contact us? ---------------------------------------------- Using EMAIL: 1) Open your mail 2) Write us: [email protected] backup address: [email protected] [email protected] TO SEND TO THE EMAIL ONLY PERSONAL ID!!! YOUR PERSONAL ID, ATTACH IT: beRv79st1xwM9NTHA1NluiebVXTdr4FS0eRnD5W9wMjAqbKQctyvdxbYuZ8e !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

Emails

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: E7A475C8A564BE3A849FC90EBAC903D6

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

Extracted

Path

C:\Users\Admin\Documents\Fucking_it.txt

Ransom Note

----> Us Nexus Hackers . Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com (Your Systeam Hacked By Us Nexus Hackers White Force) ------- Contact Telegram Group The Virus Upload On Your Mother Board Bios Systeam Or Gpu Bios - (-Warning Dont Reset-Factory You Will Reset Your PC Will Be Crash Burn You Cpu Shell-) Contact ---- Gmail- [email protected] ----- Telegram- https://t.me/usnexushacker ----- Telegram-id Hide Contact Gmail Credit White Hackers -------------------- Cyber Security -------------------- Defance All War ---------------------- Website https://www.propub3r6espa33w.onion Dont Visit The Site Payment informationAmount: 0.3 BTC Bitcoin Wallet: 3LrDFbp6fRqkXE45bLipnrQNg9wMKyTR5S

Emails

[email protected]

Wallets

3LrDFbp6fRqkXE45bLipnrQNg9wMKyTR5S

URLs

https://t.me/usnexushacker
https://www.propub3r6espa33w.onion

Targets

- Target
  01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
- Size 155KB
- SHA256 01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550
- MD5 7e3b2b10d66955465c12da9f2ab43e36
- SHA1 2ee3d7ce4ec3461026e910fdfcf9d18dd43eb380
- SHA512 ce37aff2e2aba9d6434454e17bafeebc47e9d86a716fcd9732bc03bf6484c4b6428d43322279b9273c3e5386ce924853d3aebf90178b2fa5009d63e1defd47a0
- SSDEEP 3072:l5K/B0toLuSNJilZHQsozTS+SMqqDL2/TrKLOG:lcytw7a1yTS+xqqDL6HKL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1
- Target
  01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
- Size 79KB
- SHA256 01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f
- MD5 f9afb31bc17811e5ab4fa406f105b1fe
- SHA1 d1a9449dcc8a3aa0c887bce71f128866175f679a
- SHA512 6feca3dfa221b704208754e67bcdce02a2253961da098b3e376d11217cd00b9f77e42f37f242e1a1f4b759b5fd172c29c9f153fce32eace48e07e802aff40b55
- SSDEEP 1536:SX6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:uhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

babuk darkside defense_evasion execution impact ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (189) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
- Size 70KB
- SHA256 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6
- MD5 58d6eab3aafd9139a2f1c7606ecd4cef
- SHA1 4152a7431b3d5dd8b0f6ad08148cb166315f41e9
- SHA512 ae92012d8401c886cb898ac0134db1567aaefb467d04d7afdb4e3e6b390b929dc353467d55b8cce5f3c74c942ac79ce565c172e296468ac44b3d8bd730a52c49
- SSDEEP 1536:ZZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:wd5BJHMqqDL2/Ovvdr
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
- Size 92KB
- SHA256 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
- MD5 786ce74458720ec55b824586d2e5666d
- SHA1 6f62e7fe75a0876939e0dd95d314b83e25e1e395
- SHA512 083fe6cde08dac05043ecc0fdbc8b26b0764de7f651ad19e96a937bc27de96242f1763b701b308eab7e0b9a8dd88cbc45e9c891de505b5348581acd4e1495c33
- SSDEEP 1536:mBwl+KXpsqN5vlwWYyhY9S4A9eAzVbobr+t+NK1GcoDc50cO2tqpbe:Qw+asqN5aW/hL2UVEnHKIcAtcO2tqpb
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

dharma defense_evasion execution impact persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (317) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral4
- Target
  1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
- Size 92KB
- SHA256 1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9
- MD5 a23219bddf6b154ca2f5afa89cb2b0c3
- SHA1 0d63eb57023770b53b6b31f669a03bbdb7a2465b
- SHA512 65583cfa9c2d77330e15a5bfce430831b53bf1b018757fa8778618bef44b87b15d20a9bbcd80a1526bb6c582df3b8ff55f0cc7b002c4a1655c3f1ace01d54172
- SSDEEP 1536:tBwl+KXpsqN5vlwWYyhY9S4AYgfEHB0tRYn+9jsGGqbg8IIvoBec5wOmh:Hw+asqN5aW/hLmDHyt0KaIvogn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
- Size 2.0MB
- SHA256 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813
- MD5 fa06e6aadef2365052156f12c92d7b09
- SHA1 82de91795547028be327e75cee0fdf082352bfc9
- SHA512 1629a2d234c70e7f1f5927b5a816c80b9fb2c995b4b334ff994848d3c7fe1c8797b231c4baaa63ca1e837081e9859c3ca138cd76a1db314c6b98685f5489566e
- SSDEEP 24576:a5SndG2iSNjN2w9Os9cRfO/d8mT6c6aVqwPhUMelU+V:aMfJqsgXmgyJPE
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral6
- Target
  1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
- Size 155KB
- SHA256 1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e
- MD5 f70cabb50328b089d00f82808f7e2563
- SHA1 9fd6765c2a42120042dd437fcb4468a448c64725
- SHA512 baf5abd87d7267d1b89b9779c2781604bbcdba40afab2fe4e43bd6ddb0500c89f3502a879503d6b0303da2aa169420cbd8e3ca7c85efa8604b127171c6234cec
- SSDEEP 3072:S5K/B0toLQSNJwlxwsx89TSdBgjMqqDL2/TOKyRGA:ScytwtLTTSdBgQqqDL6SKNA
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7
- Target
  1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
- Size 432KB
- SHA256 1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db
- MD5 7da83e0a63039ac6aec5b8cbc31d20d6
- SHA1 6b1d7db9600cc88922b9a213f7b30f29fe5bc20e
- SHA512 f988d36e9e67b2c8ef70968edd3de817614cf20a3a6041d77c627501186b36b4a6904e51acce876f772f0593975af1d2e50e882ba562a79c24a2ee6e1b5f0ac6
- SSDEEP 12288:iKPmrLbovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSi
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral8
- Target
  1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
- Size 490KB
- SHA256 1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89
- MD5 2d23c83d6941cf484da19d4367c02df0
- SHA1 b63dd1f2e35d8944dee745321643f06037dfe95e
- SHA512 28a5d2df80e9a1c5eeb65938479b7b96f754feff28244f91304361bd4c238d533f01d37598eedc95c6549c9066c8f15b2ce16262e02ce944dd47ed6e123ef797
- SSDEEP 12288:wIOfQgbI1D/Tj7MACdotmELTtqGJouy9JtsmRrTNaTI7rERFUZ1K1s9L01:rt0v4yPpS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral9
- Target
  1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
- Size 362KB
- SHA256 1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d
- MD5 2e81a8097ac6d1902db1f74863b41c39
- SHA1 4b3a78491246f78566ec444a1c22226746a53a21
- SHA512 bcf78e32b58e559bc06067aa360630e6ac85cb9b1f120580b93c2c1e3ae051590eb406c8650bee122970d105e3359f27e6f85b2dd60da2c69ea762dc2c600b49
- SSDEEP 6144:siW7SDayqQXtokkfP6MyMQZVHewrBtM70H4dy/lrDJYgQ1qUbfc:liwdvmqVxrrlrDygfV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
- Size 159KB
- SHA256 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b
- MD5 ef577a1a486aa3dba1b0acd46b54d3a6
- SHA1 24897bc96bec3126c4a65c96b907fe57bd75359f
- SHA512 9aae8575f067614dc9bb64c3d7ac604693500922780ae81a60d7cbcee91c3c12f9e20c7fdaf9a665a58e9c314cd4c185925719bc29ae2b702879d770a2a39e39
- SSDEEP 3072:JuJ9OlKolUa1U197bzhVsmftsu3ieOfNqv1wxfs3Q0hU:Jufj0zi1dNVsmftSyyxU3Q0e
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lockbit ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11
- Target
  1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
- Size 179KB
- SHA256 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845
- MD5 c2fea37aa19c947614c20fe2ad3aeef2
- SHA1 16834915e3db38b5b954c2099d77bcb700428588
- SHA512 e5d86b7d03c3428c59b0d0bc7e57089abc8dc8baf3dd9dde47852c43ede1e48804851cfb3ed018121b78248f8e75ed7049ea8b2d6ed6303df36514a016e98e59
- SSDEEP 3072:ZTO/rWaQcrcfX25Qs9jRzj/rvV9Yecqj3:tO/rWayXIFVj/rvV9B
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

persistence ransomware
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral12
- Target
  1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
- Size 1.2MB
- SHA256 1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef
- MD5 f645b68f97b49c8d120158e7fd7f1460
- SHA1 b8673e2041966ace9d643106ba2aa1e69c3b9cd7
- SHA512 685594d277c7d09649fa5b3b0d363714f524be0116cdedab92b5f617e41c7a40573055f1d20d85eb629feb9e55d324a06e9e6ed7297a78d179108c4f7e57eb36
- SSDEEP 24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/BRPOO8xGKUq7:F0dwAYZt6C31WeT5RPOhxzUq7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
- Size 6.4MB
- SHA256 1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd
- MD5 356388cdb4f74188812fa44c0aef000b
- SHA1 59130f7b2e63422da6f620fa29cc6837903584cb
- SHA512 11ba99f6a151675408f76f4c02d10a80a60f74d6c4e0ef794043d36237b002cf8ab577421758f16fe678f1f190782aba7adbdf33c87693c379dd18e3176dae83
- SSDEEP 98304:f/qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8jHI:f/qPe1Cxcxk3ZAEUadzR8jHI
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

wannacry ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Executes dropped EXE
- Drops file in System32 directory
behavioral14
- Target
  1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
- Size 2.4MB
- SHA256 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0
- MD5 84e2bf751724e3b0acc70b67ee1b8e96
- SHA1 2e1c9638b022901d67c69ef17c6acd12fd6e493f
- SHA512 56a229897c812cddd7f0b1847cf439f910350aa11138f7165b7c7f697095dfe5ee64e875e4262706c20e7bdbb59a94512386965e83ac9327b0b6967377882aef
- SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCp:eEtl9mRda12sX7hKB8NIyXbacAfe
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Renames multiple (91) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral15
- Target
  1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
- Size 92KB
- SHA256 1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788
- MD5 a3435d1839ded089f36516c52e94f5d3
- SHA1 ffa7bf12d73d61c7cd09070f2d680c1b0eec4990
- SHA512 b3bf2296104cff14836cac3391cb12ee1ca9055673f2855bee45f552bcaf085053d1504ad5d141620e7f4a50ee407bbd8db2844cb32747cb5631efd2daaccd86
- SSDEEP 1536:tBwl+KXpsqN5vlwWYyhY9S4AwGOFr82UvQJwK:Hw+asqN5aW/hLe3rrJw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
- Size 112KB
- SHA256 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1
- MD5 b6cfdefd2ef6bb507cbac8634ec3f6a1
- SHA1 583bbf424a7114586dd48fe57be999cbd750ba56
- SHA512 5b8ea7112f2f5ef2f34ac18b9ce8b3afc0016c4603fe222a02a8fc03e115890bcdb4929db273026aded00aa8a226cd49c2b5cd1279086aea049c13ae7608f5e1
- SSDEEP 1536:R2HSDWrKs9S4AZvJHU4mKQvXqWJLsYfgIXE0FtRhSH0SJE3PpgNmKRUM:RjaWP3vQNJLsUE03RA1eP87
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

defense_evasion execution impact persistence ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (317) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral17
- Target
  1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe
- Size 16.0MB
- SHA256 1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba
- MD5 3031071c4a4b9c780bcc794fecf5c62b
- SHA1 8249394839971405c3193a47fa8defdd2f7e6945
- SHA512 1233e6bcb7ae1d6f5d3ea5eac7eab0486728a7a588686b5a40560a4759669d308998c76821db106b9fb22e44fb5448ab2b51c7136498e335ac55dc0bfb19d9e5
- SSDEEP 3072:S5K/B0toLOSNJvlxwsx89TSdBgjMqqDL2/TOKeHXGl:Scytwb+TTSdBgQqqDL6SKS2
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18
- Target
  1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe
- Size 155KB
- SHA256 1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044
- MD5 bface344d14f9503aab7e59a99db6124
- SHA1 9d4e54f418f78ff7f068aeb80e6fa6dc1ac174d2
- SHA512 71406823116eadc26a3ea3c05f6d19aa0f000cd09fd402861bcf827607ae09bce6315e7572cbfca2e897b1c8962f9628cd3f71ce38a9d3156279b354bea6c0b9
- SSDEEP 3072:l5K/B0toLQSNJklZHQsozTS+SMqqDL2/TrKG+G:lcytwtQ1yTS+xqqDL6HKS
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19
- Target
  1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe
- Size 564KB
- SHA256 1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc
- MD5 99cc504910231308cd759c3c0b1a00ac
- SHA1 f884e5fcd3da589a0ee6036cb970e704cf511599
- SHA512 8f35a7c7d7708f8a04755560e0b672bda1744580b2d62337408cac6c3803ea4aa1c8a8894d57c9cf6aba10600456431956e230db07fe4a974ae337fedc08ea8e
- SSDEEP 3072:9Ry5r313/OQi2YcRVm16Pn6h0Hxq1MSp9i2YcRPm16Pn6ckC1jEyE9a5Zt1pDrQs:AJ3XiWm16mW6biym16rtCiym168
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

chaos ransomware
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
behavioral20
- Target
  1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe
- Size 155KB
- SHA256 1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386
- MD5 7c693f1b689200dfa293bc59c8d2ad9d
- SHA1 ab7154a7d8e589bb91d19cb40a971667ff1b47f3
- SHA512 03ccde57d1a101508a9e7a55051bdf0869a866085ac1746b54f915883f31c4f371c2f293f068390458ac4b94ccf72bbc5fc9dbdf5e6979cc9276132693739838
- SSDEEP 3072:S5K/B0toL1SNJ5lxwsx89TSdBgjMqqDL2/TOKu5G:ScytwogTTSdBgQqqDL6SKd
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21
- Target
  1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069.exe
- Size 17KB
- SHA256 1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069
- MD5 f956092a030e34b7d7b471383ce7e52a
- SHA1 de678ee647b172c134134ce953ad386f6e5e4021
- SHA512 a557b4ba5da1c964e04601a1de604becd8957c07000a901c04779d956236c7e40de4332bb9473dc0f87be0c417407da1026594202c8d23ac5c69b9002f6a4c71
- SSDEEP 384:1duTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zzWMQhW3WMv5:1du9CaxEovcm/BCvXcO5
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10
behavioral22
- Target
  1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe
- Size 70KB
- SHA256 1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9
- MD5 4b1923e619b4a9e1f7a64358a1ac2de3
- SHA1 fa50e0e19dd1dfedcf5fb23c709c60cb8f78accc
- SHA512 c5b96fbfc6a4f0cf29b200a2d9682f51251ecfcc6ebfe12e04393473c57c82b1d08e474db5322d20069f6aef6223db379d114f92e39e403762ab302313c2a6de
- SSDEEP 1536:GZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:1d5BJHMqqDL2/OvvdrH
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23
- Target
  1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe
- Size 178KB
- SHA256 1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be
- MD5 53bd35774b8d36830b5bee75acf375b2
- SHA1 c3a26e55ca87614b1eb94975d73aa39979654322
- SHA512 bcd8e164896972d46ebf325af3d1d10451a897eb3221a8cfc5191023b2b1512034f9945efc2326f21170ce241a46718dda069ce19cce8ecc8af4047cec6346d3
- SSDEEP 3072:b5BZ6q9elWNIG+9tv+9q9tBFKfpYnmig3/Vl0hpVervREDLUYwEx4:lBZ6q9Ju3HFKDi3pOeLb4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24
- Target
  1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
- Size 14.9MB
- SHA256 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e
- MD5 97abffeaa7bdfaa81532bd6028498225
- SHA1 26ab576a0abf7085ecf6321a311a7b3088ee48ae
- SHA512 af271b15a4f64ac4965cc75f7531e28d3ea0abc90d16ae4654251a301d1a3a0b10d80b205dc626b8866c976ffacdace74f71711c73ef1240d867aeb09c47cc75
- SSDEEP 196608:aMygJ9edfbhSo5Kp8qPKlL8QgYVhqhOM8qTsSqwLM:7XJ9e1wo548qSV5VhKOeTsRwLM
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

azov persistence ransomware spyware stealer wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (1055) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe
- Size 362KB
- SHA256 2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1
- MD5 f9951f5e40c21a78a631ab7b4a60ba89
- SHA1 5d73c066e1ba881f038c049fbafcb28070b4fe26
- SHA512 96a4c3387636971511cc1146fc5e9c9a454a98e3f1cdb52e52127a565171aa4977f041efd15f2eb8f268bf6138c23b0a061025339acb8f66ba5a1f41d3e12024
- SSDEEP 6144:UeyWvDVBSuFPRxMmcAk/eP8ph6sy4oV9bisv9tvX4FO/5VdPFMBWQRq+MCS:RyADhzveeP8p89dvn5VdPacbhR
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26
- Target
  2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe
- Size 205KB
- SHA256 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4
- MD5 5e9e6b90b530260d1f6dd462a9a2fa16
- SHA1 3caa6e6d2aed85b9ea046a077a972c2a1718ee7b
- SHA512 2a0e6f2687e3bbb4158ce7bfc46b1c86794cb23fdbb041d0e5735b0e2674a9b27259edee3044e58202528e72e6c1b2ab6c4f7aeabb193f9d7f48b5bb60211f62
- SSDEEP 6144:+B4Fr9NzqHW7V5V9w/UIRZizI1aqebq/lsyp:+B45qHW7nU/pZmiXqy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (206) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral27
- Target
  2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
- Size 959KB
- SHA256 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695
- MD5 2525d5867b27f5ee3949880186c35ed7
- SHA1 8fc6dd893d10eb3f4d7c06fda1d3e05a8c7ba8ad
- SHA512 589b76ae5cddff763af93164eb817cf971a3a137a7d3a6ad6ac8c3dfcb703c49c13afb69c00d1984edbfeecc63cdefa4a6b78e1c70f6b65fb057e0e82c526376
- SSDEEP 24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdRF:Ujrc2So1Ff+B3k796r
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lockbit defense_evasion discovery evasion execution impact persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral28
- Target
  2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc.exe
- Size 432KB
- SHA256 2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc
- MD5 d600d6c7d26ddb9f4aa0f0474aba5cc4
- SHA1 a0944d3cef8e03dcb71025c1ab5b6c6bfb638789
- SHA512 888602f9b88bfcd99c56bca2d80541f6bf423f5530983360854a9a5bf27bddf6251f5bf9175705eb2898294898dbd0ad79b354c4c7e4f746f84807308c49f510
- SSDEEP 12288:iKPmrLeovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSV
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral29
- Target
  2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8.exe
- Size 196KB
- SHA256 2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8
- MD5 18c062ae3a545ade59842cafe5b17ea8
- SHA1 0bf7e78f698eabe7811629e12052493401bc7095
- SHA512 480584079e8cb3a6f8d9010c12348d6969a423c667e8576f6f984d3b4395aff163ef0e2a0cb01785ab8bb0d14d8fe22a5b16f55a0907e489af875fb16324e2ef
- SSDEEP 3072:z+PkbTWYtBzNgnbRh6JuB/fnDkjjdqxEIezD91+UB77:6s2cBCbRdB/fnDkjXIuRx7
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral30
- Target
  2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb.exe
- Size 2.4MB
- SHA256 2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb
- MD5 1aaee486a62300dd74c2d236a4945527
- SHA1 0a22357d6c3ccf5a3a5dbabf6e7ad874e97c1b46
- SHA512 27f681dadcab2646c3e831af145c2faac9b9265a46f3b027f9824519a9ba60912b277b4bfb90aa3d9fe989961667019353af09546bfdd0b850d656323df47643
- SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCG:eEtl9mRda12sX7hKB8NIyXbacAfh
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Renames multiple (91) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral31
- Target
  2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7.exe
- Size 5.0MB
- SHA256 2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7
- MD5 e868a305cfda3903526adc37daf56e6d
- SHA1 11148b1bafb29ffbd30ab3eccc88de9648b756a8
- SHA512 bcb38bdb1faf2ef6a112e2f63c06d8423f649939f074228a78ff72f80abe313e9238801a059a3a931523157ac7ce71b52f49cb30fb7de5f4f3125fa7556c7b15
- SSDEEP 98304:YDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:YDqPe1Cxcxk3ZAEUadzR8yc4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3189) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Babuk Locker

DarkSide

Deletes shadow copies

Renames multiple (189) files with added filename extension

Enumerates connected drives

Adds Run key to start application

Enumerates connected drives

Dharma

Deletes shadow copies

Renames multiple (317) files with added filename extension

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Chaos

Chaos Ransomware

Deletes shadow copies

Modifies boot configuration data using bcdedit

Deletes backup catalog

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Chaos

Chaos Ransomware

Deletes shadow copies

Modifies boot configuration data using bcdedit

Deletes backup catalog

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Lockbit

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Sets desktop wallpaper using registry

Wannacry

Executes dropped EXE

Drops file in System32 directory

Modifies WinLogon for persistence

Renames multiple (91) files with added filename extension

Drops startup file

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Drops autorun.inf file

Drops file in System32 directory

Deletes shadow copies

Renames multiple (317) files with added filename extension

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Sets desktop wallpaper using registry

Chaos

Chaos Ransomware

Adds Run key to start application

Enumerates connected drives

Renames multiple (1055) files with added filename extension

Reads user/profile data of web browsers