Extracted

• • Target

    pcwallpaper1.jpg

  • Size

    2.8MB

  • MD5

    f0dfc4234473c72624c5ebb54c85e3bd

  • SHA1

    16faaf731199084de4b6e7738a945de12ba18ef0

  • SHA256

    eaff50eecfd88126ee71a6988703f95f2a5721148bee36405013d1b39129666c

  • SHA512

    a9504be3c43009a4296578cb5fa791868d89a02d497f73605f0abeeade81935e273eb36f6d8ea869c762082ac09233edcebabfaffd881f3c9f765edca033ec9c

  • SSDEEP

    49152:UIJsjnko2yOsRhsRUn72VPsomkOMlFlgyh/UenXT9daWyLb3WTW3UUJDA3xK:Uosj3jhsGn7wsxkOMTlggznjty2qhJUs

  Score

  10^/10

  cryptolockertroldeshwannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealertrojanworm

  • CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2