azov

Sharing

Copy URL

Twitter E-mail

General

Target

002.7z
Size

11.2MB
Sample

240713-lf7nhsvgrp
MD5

82180da2d9ecde4947a618ff1a37fdad
SHA1

ae327ea9229498e86afb337b87cf6d6f4caaa309
SHA256

cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278
SHA512

606ddfb833eb38952403ae10e9eec694d45e3fb2df326d5825f93257d605552868343e80fd6e3a497d690dabe8ed1493b60843118f1aa5412be8cc55a66335a3
SSDEEP

196608:nYcNyJpHBLBc6gKWYZzbK26sqaddXpgPxydfcNQChzHayMxpJ51LipiFe5TZD0B:n5yJ1pB+KWYtbK26sq25GyxcR6yMt51L

Malware Config

Extracted

Path

C:\Users\ooxlOmJxX.README.txt

Family

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest and most stable ransomware from 2019~~~ >>>>> Your data is stolen and encrypted. If you don't pay the ransom, the data will be published on our TOR darknet sites. Keep in mind that once your data appears on our leak site, it could be bought by your competitors at any second, so don't hesitate for a long time. The sooner you pay the ransom, the sooner your company will be safe. Tor Browser Links: http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion Links for normal browser: http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly >>>>> What guarantee is there that we won't cheat you? We are the oldest ransomware affiliate program on the planet, nothing is more important than our reputation. We are not a politically motivated group and we want nothing more than money. If you pay, we will provide you with decryption software and destroy the stolen data. After you pay the ransom, you will quickly make even more money. Treat this situation simply as a paid training for your system administrators, because it is due to your corporate network not being properly configured that we were able to attack you. Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and pay for it. If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future. You can get more information about us on Ilon Musk's Twitter https://twitter.com/hashtag/lockbit?f=live >>>>> You need to contact us and decrypt one file for free on TOR darknet sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from you. If you need a unique ID for correspondence with us that no one will know about, tell it in the chat, we will generate a secret chat for you and give you his ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser personal link available only to you (available during a ddos attack): http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion Tor Browser Links for chat (sometimes unavailable due to ddos attacks): http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal ID: B51C595D54036891C97A343D13B59749 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They won't help and will only make things worse for you. In 3 years not a single member of our group has been caught by the police, we are top notch hackers and we never leave a trail of crime. The police will try to prohibit you from paying the ransom in any way. The first thing they will tell you is that there is no guarantee to decrypt your files and remove stolen files, this is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it is a matter of our reputation, we make hundreds of millions of dollars and are not going to lose our revenue because of your files. It is very beneficial for the police and FBI to let everyone on the planet know about your data leak because then your state will get the fines budgeted for you due to GDPR and other similar laws. The fines will be used to fund the police and the FBI, they will eat more sweet coffee donuts and get fatter and fatter. The police and the FBI don't care what losses you suffer as a result of our attack, and we will help you get rid of all your problems for a modest sum of money. Along with this you should know that it is not necessarily your company that has to pay the ransom and not necessarily from your bank account, it can be done by an unidentified person, such as any philanthropist who loves your company, for example, Elon Musk, so the police will not do anything to you if someone pays the ransom for you. If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom. The police and FBI will not be able to stop lawsuits from your customers for leaking personal and private information. The police and FBI will not protect you from repeated attacks. Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees. >>>>> What are the dangers of leaking your company's data. First of all, you will receive fines from the government such as the GDRP and many others, you can be sued by customers of your firm for leaking information that was confidential. Your leaked data will be used by all the hackers on the planet for various unpleasant things. For example, social engineering, your employees' personal data can be used to re-infiltrate your company. Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. On another vacation trip, you will have to explain to the FBI where you got millions of dollars worth of stolen cryptocurrency transferred through your accounts on cryptocurrency exchanges. Your personal information could be used to make loans or buy appliances. You would later have to prove in court that it wasn't you who took out the loan and pay off someone else's loan. Your competitors may use the stolen information to steal technology or to improve their processes, your working methods, suppliers, investors, sponsors, employees, it will all be in the public domain. You won't be happy if your competitors lure your employees to other firms offering better wages, will you? Your competitors will use your information against you. For example, look for tax violations in the financial documents or any other violations, so you have to close your firm. According to statistics, two thirds of small and medium-sized companies close within half a year after a data breach. You will have to find and fix the vulnerabilities in your network, work with the customers affected by data leaks. All of these are very costly procedures that can exceed the cost of a ransomware buyout by a factor of hundreds. It's much easier, cheaper and faster to pay us the ransom. Well and most importantly, you will suffer a reputational loss, you have been building your company for many years, and now your reputation will be destroyed. Read more about the GDRP legislation:: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr.eu/what-is-gdpr/ https://gdpr-info.eu/ >>>>> Don't go to recovery companies, they are essentially just middlemen who will make money off you and cheat you. We are well aware of cases where recovery companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us directly without intermediaries you would pay 5 times less, that is 1 million dollars. >>>> Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction. >>>>> If you do not pay the ransom, we will attack your company again in the future.

URLs

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion

http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion

http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly

http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly

http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

https://twitter.com/hashtag/lockbit?f=live

http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion

Extracted

Path

C:\Users\How To Restore Your Files.txt

Family

darkside

Ransom Note

----------- [ Hello! ] -------------> ****BY BABUK LOCKER**** What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. How to contact us? ---------------------------------------------- Using EMAIL: 1) Open your mail 2) Write us: [email protected] backup address: [email protected] [email protected] TO SEND TO THE EMAIL ONLY PERSONAL ID!!! YOUR PERSONAL ID, ATTACH IT: beRv79st1xwM9NTHA1NluiebVXTdr4FS0eRnD5W9wMjAqbKQctyvdxbYuZ8e !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

Emails

[email protected]

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: E7A475C8A564BE3A849FC90EBAC903D6

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Extracted

Path

C:\Users\Admin\Documents\Fucking_it.txt

Ransom Note

----> Us Nexus Hackers . Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com (Your Systeam Hacked By Us Nexus Hackers White Force) ------- Contact Telegram Group The Virus Upload On Your Mother Board Bios Systeam Or Gpu Bios - (-Warning Dont Reset-Factory You Will Reset Your PC Will Be Crash Burn You Cpu Shell-) Contact ---- Gmail- [email protected] ----- Telegram- https://t.me/usnexushacker ----- Telegram-id Hide Contact Gmail Credit White Hackers -------------------- Cyber Security -------------------- Defance All War ---------------------- Website https://www.propub3r6espa33w.onion Dont Visit The Site Payment informationAmount: 0.3 BTC Bitcoin Wallet: 3LrDFbp6fRqkXE45bLipnrQNg9wMKyTR5S

Emails

[email protected]

Wallets

3LrDFbp6fRqkXE45bLipnrQNg9wMKyTR5S

URLs

https://t.me/usnexushacker

https://www.propub3r6espa33w.onion

Targets

- Target
  
  01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
- Size
  
  155KB
- MD5
  
  7e3b2b10d66955465c12da9f2ab43e36
- SHA1
  
  2ee3d7ce4ec3461026e910fdfcf9d18dd43eb380
- SHA256
  
  01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550
- SHA512
  
  ce37aff2e2aba9d6434454e17bafeebc47e9d86a716fcd9732bc03bf6484c4b6428d43322279b9273c3e5386ce924853d3aebf90178b2fa5009d63e1defd47a0
- SSDEEP
  
  3072:l5K/B0toLuSNJilZHQsozTS+SMqqDL2/TrKLOG:lcytw7a1yTS+xqqDL6HKL
Score

3^/10
behavioral1
- Target
  
  01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
- Size
  
  79KB
- MD5
  
  f9afb31bc17811e5ab4fa406f105b1fe
- SHA1
  
  d1a9449dcc8a3aa0c887bce71f128866175f679a
- SHA256
  
  01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f
- SHA512
  
  6feca3dfa221b704208754e67bcdce02a2253961da098b3e376d11217cd00b9f77e42f37f242e1a1f4b759b5fd172c29c9f153fce32eace48e07e802aff40b55
- SSDEEP
  
  1536:SX6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:uhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
Score

10^/10

babuk darkside defense_evasion execution impact ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (189) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  
  02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
- Size
  
  70KB
- MD5
  
  58d6eab3aafd9139a2f1c7606ecd4cef
- SHA1
  
  4152a7431b3d5dd8b0f6ad08148cb166315f41e9
- SHA256
  
  02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6
- SHA512
  
  ae92012d8401c886cb898ac0134db1567aaefb467d04d7afdb4e3e6b390b929dc353467d55b8cce5f3c74c942ac79ce565c172e296468ac44b3d8bd730a52c49
- SSDEEP
  
  1536:ZZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:wd5BJHMqqDL2/Ovvdr
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  
  1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
- Size
  
  92KB
- MD5
  
  786ce74458720ec55b824586d2e5666d
- SHA1
  
  6f62e7fe75a0876939e0dd95d314b83e25e1e395
- SHA256
  
  1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
- SHA512
  
  083fe6cde08dac05043ecc0fdbc8b26b0764de7f651ad19e96a937bc27de96242f1763b701b308eab7e0b9a8dd88cbc45e9c891de505b5348581acd4e1495c33
- SSDEEP
  
  1536:mBwl+KXpsqN5vlwWYyhY9S4A9eAzVbobr+t+NK1GcoDc50cO2tqpbe:Qw+asqN5aW/hL2UVEnHKIcAtcO2tqpb
Score

10^/10

dharma defense_evasion execution impact persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (317) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral4
- Target
  
  1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
- Size
  
  92KB
- MD5
  
  a23219bddf6b154ca2f5afa89cb2b0c3
- SHA1
  
  0d63eb57023770b53b6b31f669a03bbdb7a2465b
- SHA256
  
  1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9
- SHA512
  
  65583cfa9c2d77330e15a5bfce430831b53bf1b018757fa8778618bef44b87b15d20a9bbcd80a1526bb6c582df3b8ff55f0cc7b002c4a1655c3f1ace01d54172
- SSDEEP
  
  1536:tBwl+KXpsqN5vlwWYyhY9S4AYgfEHB0tRYn+9jsGGqbg8IIvoBec5wOmh:Hw+asqN5aW/hLmDHyt0KaIvogn
Score

1^/10
behavioral5
- Target
  
  1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
- Size
  
  2.0MB
- MD5
  
  fa06e6aadef2365052156f12c92d7b09
- SHA1
  
  82de91795547028be327e75cee0fdf082352bfc9
- SHA256
  
  1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813
- SHA512
  
  1629a2d234c70e7f1f5927b5a816c80b9fb2c995b4b334ff994848d3c7fe1c8797b231c4baaa63ca1e837081e9859c3ca138cd76a1db314c6b98685f5489566e
- SSDEEP
  
  24576:a5SndG2iSNjN2w9Os9cRfO/d8mT6c6aVqwPhUMelU+V:aMfJqsgXmgyJPE
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral6
- Target
  
  1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
- Size
  
  155KB
- MD5
  
  f70cabb50328b089d00f82808f7e2563
- SHA1
  
  9fd6765c2a42120042dd437fcb4468a448c64725
- SHA256
  
  1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e
- SHA512
  
  baf5abd87d7267d1b89b9779c2781604bbcdba40afab2fe4e43bd6ddb0500c89f3502a879503d6b0303da2aa169420cbd8e3ca7c85efa8604b127171c6234cec
- SSDEEP
  
  3072:S5K/B0toLQSNJwlxwsx89TSdBgjMqqDL2/TOKyRGA:ScytwtLTTSdBgQqqDL6SKNA
Score

3^/10
behavioral7
- Target
  
  1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
- Size
  
  432KB
- MD5
  
  7da83e0a63039ac6aec5b8cbc31d20d6
- SHA1
  
  6b1d7db9600cc88922b9a213f7b30f29fe5bc20e
- SHA256
  
  1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db
- SHA512
  
  f988d36e9e67b2c8ef70968edd3de817614cf20a3a6041d77c627501186b36b4a6904e51acce876f772f0593975af1d2e50e882ba562a79c24a2ee6e1b5f0ac6
- SSDEEP
  
  12288:iKPmrLbovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSi
Score

3^/10
behavioral8
- Target
  
  1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
- Size
  
  490KB
- MD5
  
  2d23c83d6941cf484da19d4367c02df0
- SHA1
  
  b63dd1f2e35d8944dee745321643f06037dfe95e
- SHA256
  
  1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89
- SHA512
  
  28a5d2df80e9a1c5eeb65938479b7b96f754feff28244f91304361bd4c238d533f01d37598eedc95c6549c9066c8f15b2ce16262e02ce944dd47ed6e123ef797
- SSDEEP
  
  12288:wIOfQgbI1D/Tj7MACdotmELTtqGJouy9JtsmRrTNaTI7rERFUZ1K1s9L01:rt0v4yPpS
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral9
- Target
  
  1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
- Size
  
  362KB
- MD5
  
  2e81a8097ac6d1902db1f74863b41c39
- SHA1
  
  4b3a78491246f78566ec444a1c22226746a53a21
- SHA256
  
  1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d
- SHA512
  
  bcf78e32b58e559bc06067aa360630e6ac85cb9b1f120580b93c2c1e3ae051590eb406c8650bee122970d105e3359f27e6f85b2dd60da2c69ea762dc2c600b49
- SSDEEP
  
  6144:siW7SDayqQXtokkfP6MyMQZVHewrBtM70H4dy/lrDJYgQ1qUbfc:liwdvmqVxrrlrDygfV
Score

1^/10
behavioral10
- Target
  
  1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
- Size
  
  159KB
- MD5
  
  ef577a1a486aa3dba1b0acd46b54d3a6
- SHA1
  
  24897bc96bec3126c4a65c96b907fe57bd75359f
- SHA256
  
  1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b
- SHA512
  
  9aae8575f067614dc9bb64c3d7ac604693500922780ae81a60d7cbcee91c3c12f9e20c7fdaf9a665a58e9c314cd4c185925719bc29ae2b702879d770a2a39e39
- SSDEEP
  
  3072:JuJ9OlKolUa1U197bzhVsmftsu3ieOfNqv1wxfs3Q0hU:Jufj0zi1dNVsmftSyyxU3Q0e
Score

10^/10

lockbit ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11
- Target
  
  1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
- Size
  
  179KB
- MD5
  
  c2fea37aa19c947614c20fe2ad3aeef2
- SHA1
  
  16834915e3db38b5b954c2099d77bcb700428588
- SHA256
  
  1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845
- SHA512
  
  e5d86b7d03c3428c59b0d0bc7e57089abc8dc8baf3dd9dde47852c43ede1e48804851cfb3ed018121b78248f8e75ed7049ea8b2d6ed6303df36514a016e98e59
- SSDEEP
  
  3072:ZTO/rWaQcrcfX25Qs9jRzj/rvV9Yecqj3:tO/rWayXIFVj/rvV9B
Score

6^/10

persistence ransomware
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral12
- Target
  
  1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
- Size
  
  1.2MB
- MD5
  
  f645b68f97b49c8d120158e7fd7f1460
- SHA1
  
  b8673e2041966ace9d643106ba2aa1e69c3b9cd7
- SHA256
  
  1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef
- SHA512
  
  685594d277c7d09649fa5b3b0d363714f524be0116cdedab92b5f617e41c7a40573055f1d20d85eb629feb9e55d324a06e9e6ed7297a78d179108c4f7e57eb36
- SSDEEP
  
  24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/BRPOO8xGKUq7:F0dwAYZt6C31WeT5RPOhxzUq7
Score

1^/10
behavioral13
- Target
  
  1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
- Size
  
  6.4MB
- MD5
  
  356388cdb4f74188812fa44c0aef000b
- SHA1
  
  59130f7b2e63422da6f620fa29cc6837903584cb
- SHA256
  
  1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd
- SHA512
  
  11ba99f6a151675408f76f4c02d10a80a60f74d6c4e0ef794043d36237b002cf8ab577421758f16fe678f1f190782aba7adbdf33c87693c379dd18e3176dae83
- SSDEEP
  
  98304:f/qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8jHI:f/qPe1Cxcxk3ZAEUadzR8jHI
Score

10^/10

wannacry ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Executes dropped EXE
- Drops file in System32 directory
behavioral14
- Target
  
  1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
- Size
  
  2.4MB
- MD5
  
  84e2bf751724e3b0acc70b67ee1b8e96
- SHA1
  
  2e1c9638b022901d67c69ef17c6acd12fd6e493f
- SHA256
  
  1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0
- SHA512
  
  56a229897c812cddd7f0b1847cf439f910350aa11138f7165b7c7f697095dfe5ee64e875e4262706c20e7bdbb59a94512386965e83ac9327b0b6967377882aef
- SSDEEP
  
  12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCp:eEtl9mRda12sX7hKB8NIyXbacAfe
Score

10^/10

persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Renames multiple (91) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral15
- Target
  
  1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
- Size
  
  92KB
- MD5
  
  a3435d1839ded089f36516c52e94f5d3
- SHA1
  
  ffa7bf12d73d61c7cd09070f2d680c1b0eec4990
- SHA256
  
  1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788
- SHA512
  
  b3bf2296104cff14836cac3391cb12ee1ca9055673f2855bee45f552bcaf085053d1504ad5d141620e7f4a50ee407bbd8db2844cb32747cb5631efd2daaccd86
- SSDEEP
  
  1536:tBwl+KXpsqN5vlwWYyhY9S4AwGOFr82UvQJwK:Hw+asqN5aW/hLe3rrJw
Score

1^/10
behavioral16
- Target
  
  1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
- Size
  
  112KB
- MD5
  
  b6cfdefd2ef6bb507cbac8634ec3f6a1
- SHA1
  
  583bbf424a7114586dd48fe57be999cbd750ba56
- SHA256
  
  1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1
- SHA512
  
  5b8ea7112f2f5ef2f34ac18b9ce8b3afc0016c4603fe222a02a8fc03e115890bcdb4929db273026aded00aa8a226cd49c2b5cd1279086aea049c13ae7608f5e1
- SSDEEP
  
  1536:R2HSDWrKs9S4AZvJHU4mKQvXqWJLsYfgIXE0FtRhSH0SJE3PpgNmKRUM:RjaWP3vQNJLsUE03RA1eP87
Score

9^/10

defense_evasion execution impact persistence ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (317) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral17
- Target
  
  1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe
- Size
  
  16.0MB
- MD5
  
  3031071c4a4b9c780bcc794fecf5c62b
- SHA1
  
  8249394839971405c3193a47fa8defdd2f7e6945
- SHA256
  
  1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba
- SHA512
  
  1233e6bcb7ae1d6f5d3ea5eac7eab0486728a7a588686b5a40560a4759669d308998c76821db106b9fb22e44fb5448ab2b51c7136498e335ac55dc0bfb19d9e5
- SSDEEP
  
  3072:S5K/B0toLOSNJvlxwsx89TSdBgjMqqDL2/TOKeHXGl:Scytwb+TTSdBgQqqDL6SKS2
Score

1^/10
behavioral18
- Target
  
  1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe
- Size
  
  155KB
- MD5
  
  bface344d14f9503aab7e59a99db6124
- SHA1
  
  9d4e54f418f78ff7f068aeb80e6fa6dc1ac174d2
- SHA256
  
  1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044
- SHA512
  
  71406823116eadc26a3ea3c05f6d19aa0f000cd09fd402861bcf827607ae09bce6315e7572cbfca2e897b1c8962f9628cd3f71ce38a9d3156279b354bea6c0b9
- SSDEEP
  
  3072:l5K/B0toLQSNJklZHQsozTS+SMqqDL2/TrKG+G:lcytwtQ1yTS+xqqDL6HKS
Score

3^/10
behavioral19
- Target
  
  1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe
- Size
  
  564KB
- MD5
  
  99cc504910231308cd759c3c0b1a00ac
- SHA1
  
  f884e5fcd3da589a0ee6036cb970e704cf511599
- SHA256
  
  1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc
- SHA512
  
  8f35a7c7d7708f8a04755560e0b672bda1744580b2d62337408cac6c3803ea4aa1c8a8894d57c9cf6aba10600456431956e230db07fe4a974ae337fedc08ea8e
- SSDEEP
  
  3072:9Ry5r313/OQi2YcRVm16Pn6h0Hxq1MSp9i2YcRPm16Pn6ckC1jEyE9a5Zt1pDrQs:AJ3XiWm16mW6biym16rtCiym168
Score

10^/10

chaos ransomware
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
behavioral20
- Target
  
  1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe
- Size
  
  155KB
- MD5
  
  7c693f1b689200dfa293bc59c8d2ad9d
- SHA1
  
  ab7154a7d8e589bb91d19cb40a971667ff1b47f3
- SHA256
  
  1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386
- SHA512
  
  03ccde57d1a101508a9e7a55051bdf0869a866085ac1746b54f915883f31c4f371c2f293f068390458ac4b94ccf72bbc5fc9dbdf5e6979cc9276132693739838
- SSDEEP
  
  3072:S5K/B0toL1SNJ5lxwsx89TSdBgjMqqDL2/TOKu5G:ScytwogTTSdBgQqqDL6SKd
Score

3^/10
behavioral21
- Target
  
  1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069.exe
- Size
  
  17KB
- MD5
  
  f956092a030e34b7d7b471383ce7e52a
- SHA1
  
  de678ee647b172c134134ce953ad386f6e5e4021
- SHA256
  
  1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069
- SHA512
  
  a557b4ba5da1c964e04601a1de604becd8957c07000a901c04779d956236c7e40de4332bb9473dc0f87be0c417407da1026594202c8d23ac5c69b9002f6a4c71
- SSDEEP
  
  384:1duTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zzWMQhW3WMv5:1du9CaxEovcm/BCvXcO5
Score

4^/10
behavioral22
- Target
  
  1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe
- Size
  
  70KB
- MD5
  
  4b1923e619b4a9e1f7a64358a1ac2de3
- SHA1
  
  fa50e0e19dd1dfedcf5fb23c709c60cb8f78accc
- SHA256
  
  1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9
- SHA512
  
  c5b96fbfc6a4f0cf29b200a2d9682f51251ecfcc6ebfe12e04393473c57c82b1d08e474db5322d20069f6aef6223db379d114f92e39e403762ab302313c2a6de
- SSDEEP
  
  1536:GZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:1d5BJHMqqDL2/OvvdrH
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23
- Target
  
  1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe
- Size
  
  178KB
- MD5
  
  53bd35774b8d36830b5bee75acf375b2
- SHA1
  
  c3a26e55ca87614b1eb94975d73aa39979654322
- SHA256
  
  1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be
- SHA512
  
  bcd8e164896972d46ebf325af3d1d10451a897eb3221a8cfc5191023b2b1512034f9945efc2326f21170ce241a46718dda069ce19cce8ecc8af4047cec6346d3
- SSDEEP
  
  3072:b5BZ6q9elWNIG+9tv+9q9tBFKfpYnmig3/Vl0hpVervREDLUYwEx4:lBZ6q9Ju3HFKDi3pOeLb4
Score

1^/10
behavioral24
- Target
  
  1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
- Size
  
  14.9MB
- MD5
  
  97abffeaa7bdfaa81532bd6028498225
- SHA1
  
  26ab576a0abf7085ecf6321a311a7b3088ee48ae
- SHA256
  
  1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e
- SHA512
  
  af271b15a4f64ac4965cc75f7531e28d3ea0abc90d16ae4654251a301d1a3a0b10d80b205dc626b8866c976ffacdace74f71711c73ef1240d867aeb09c47cc75
- SSDEEP
  
  196608:aMygJ9edfbhSo5Kp8qPKlL8QgYVhqhOM8qTsSqwLM:7XJ9e1wo548qSV5VhKOeTsRwLM
Score

10^/10

azov persistence ransomware spyware stealer wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (1055) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  
  2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe
- Size
  
  362KB
- MD5
  
  f9951f5e40c21a78a631ab7b4a60ba89
- SHA1
  
  5d73c066e1ba881f038c049fbafcb28070b4fe26
- SHA256
  
  2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1
- SHA512
  
  96a4c3387636971511cc1146fc5e9c9a454a98e3f1cdb52e52127a565171aa4977f041efd15f2eb8f268bf6138c23b0a061025339acb8f66ba5a1f41d3e12024
- SSDEEP
  
  6144:UeyWvDVBSuFPRxMmcAk/eP8ph6sy4oV9bisv9tvX4FO/5VdPFMBWQRq+MCS:RyADhzveeP8p89dvn5VdPacbhR
Score

1^/10
behavioral26
- Target
  
  2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe
- Size
  
  205KB
- MD5
  
  5e9e6b90b530260d1f6dd462a9a2fa16
- SHA1
  
  3caa6e6d2aed85b9ea046a077a972c2a1718ee7b
- SHA256
  
  2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4
- SHA512
  
  2a0e6f2687e3bbb4158ce7bfc46b1c86794cb23fdbb041d0e5735b0e2674a9b27259edee3044e58202528e72e6c1b2ab6c4f7aeabb193f9d7f48b5bb60211f62
- SSDEEP
  
  6144:+B4Fr9NzqHW7V5V9w/UIRZizI1aqebq/lsyp:+B45qHW7nU/pZmiXqy
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (206) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral27
- Target
  
  2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
- Size
  
  959KB
- MD5
  
  2525d5867b27f5ee3949880186c35ed7
- SHA1
  
  8fc6dd893d10eb3f4d7c06fda1d3e05a8c7ba8ad
- SHA256
  
  2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695
- SHA512
  
  589b76ae5cddff763af93164eb817cf971a3a137a7d3a6ad6ac8c3dfcb703c49c13afb69c00d1984edbfeecc63cdefa4a6b78e1c70f6b65fb057e0e82c526376
- SSDEEP
  
  24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdRF:Ujrc2So1Ff+B3k796r
Score

10^/10

lockbit defense_evasion discovery evasion execution impact persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral28
- Target
  
  2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc.exe
- Size
  
  432KB
- MD5
  
  d600d6c7d26ddb9f4aa0f0474aba5cc4
- SHA1
  
  a0944d3cef8e03dcb71025c1ab5b6c6bfb638789
- SHA256
  
  2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc
- SHA512
  
  888602f9b88bfcd99c56bca2d80541f6bf423f5530983360854a9a5bf27bddf6251f5bf9175705eb2898294898dbd0ad79b354c4c7e4f746f84807308c49f510
- SSDEEP
  
  12288:iKPmrLeovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSV
Score

3^/10
behavioral29
- Target
  
  2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8.exe
- Size
  
  196KB
- MD5
  
  18c062ae3a545ade59842cafe5b17ea8
- SHA1
  
  0bf7e78f698eabe7811629e12052493401bc7095
- SHA256
  
  2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8
- SHA512
  
  480584079e8cb3a6f8d9010c12348d6969a423c667e8576f6f984d3b4395aff163ef0e2a0cb01785ab8bb0d14d8fe22a5b16f55a0907e489af875fb16324e2ef
- SSDEEP
  
  3072:z+PkbTWYtBzNgnbRh6JuB/fnDkjjdqxEIezD91+UB77:6s2cBCbRdB/fnDkjXIuRx7
Score

3^/10
behavioral30
- Target
  
  2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb.exe
- Size
  
  2.4MB
- MD5
  
  1aaee486a62300dd74c2d236a4945527
- SHA1
  
  0a22357d6c3ccf5a3a5dbabf6e7ad874e97c1b46
- SHA256
  
  2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb
- SHA512
  
  27f681dadcab2646c3e831af145c2faac9b9265a46f3b027f9824519a9ba60912b277b4bfb90aa3d9fe989961667019353af09546bfdd0b850d656323df47643
- SSDEEP
  
  12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCG:eEtl9mRda12sX7hKB8NIyXbacAfh
Score

10^/10

persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Renames multiple (91) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral31
- Target
  
  2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7.exe
- Size
  
  5.0MB
- MD5
  
  e868a305cfda3903526adc37daf56e6d
- SHA1
  
  11148b1bafb29ffbd30ab3eccc88de9648b756a8
- SHA256
  
  2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7
- SHA512
  
  bcb38bdb1faf2ef6a112e2f63c06d8423f649939f074228a78ff72f80abe313e9238801a059a3a931523157ac7ce71b52f49cb30fb7de5f4f3125fa7556c7b15
- SSDEEP
  
  98304:YDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:YDqPe1Cxcxk3ZAEUadzR8yc4
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3189) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Babuk Locker

DarkSide

Deletes shadow copies

Renames multiple (189) files with added filename extension

Enumerates connected drives

Adds Run key to start application

Enumerates connected drives

Dharma

Deletes shadow copies

Renames multiple (317) files with added filename extension

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Chaos

Chaos Ransomware

Deletes shadow copies

Modifies boot configuration data using bcdedit

Deletes backup catalog

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Chaos

Chaos Ransomware

Deletes shadow copies

Modifies boot configuration data using bcdedit

Deletes backup catalog

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Lockbit

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Sets desktop wallpaper using registry

Wannacry

Executes dropped EXE

Drops file in System32 directory

Modifies WinLogon for persistence

Renames multiple (91) files with added filename extension

Drops startup file

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Drops autorun.inf file

Drops file in System32 directory

Deletes shadow copies

Renames multiple (317) files with added filename extension

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Sets desktop wallpaper using registry

Chaos

Chaos Ransomware

Adds Run key to start application

Enumerates connected drives

Renames multiple (1055) files with added filename extension

Reads user/profile data of web browsers

Adds Run key to start application