Overview

overview

10

Static

static

3

8f368b029a...8a.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.zip

  • Size

    74KB

  • Sample

    240808-rgft3svarp

  • MD5

    80dc95ed38a023342bbd0f10f0f1f953

  • SHA1

    12879e4b870fc371dda1018e797e92ed8603f5c5

  • SHA256

    e5240cb911dbff768a00aa266dfb28448181d94b750d108df73c4f56b7ec8cf8

  • SHA512

    fc89b05e450087491dcb0b40be05643df1638aa06b900a59ec969bcbe06d47184add446dcfc7a81e1a969c6a0ebda8f1514db28d0d51abac2d8f2c6c3031d7d6

  • SSDEEP

    1536:R7Ie7TbxIQHYdUbGLwLuPUk3wYUjLjo4YdQTnCWRDLYUqjbBN:R8WTdHYdUbGLFx3wYC/ouT55Y7jX

Score
10/10
ryukcredential_accessdiscoveryransomwarestealer

Malware Config

Targets

    • Target

      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

    • Size

      144KB

    • MD5

      89895cf4c88f13e5797aab63dddf1078

    • SHA1

      1efc175983a17bd6c562fe7b054045d6dcb341e5

    • SHA256

      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

    • SHA512

      d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

    • SSDEEP

      3072:eOFqYZEtiRjB+OpBmUHkRCBMmn3T/znyS4:eO8xwjBx8UHkt2DJ4

    Score
    10/10
    ryukcredential_accessdiscoveryransomwarestealer

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Renames multiple (7394) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks