Covid29 Ransomware.zip
- SHA256 bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3
Overview
overview
10Static
static
10TrojanRans...29.exe
windows7-x64
10TrojanRans...29.exe
windows10-2004-x64
10source/Bat...er.exe
windows7-x64
7source/Bat...er.exe
windows10-2004-x64
7source/Bat...lp.chm
windows7-x64
1source/Bat...lp.chm
windows10-2004-x64
1source/Cov29Cry.exe
windows7-x64
10source/Cov29Cry.exe
windows10-2004-x64
10source/Cov...v4.exe
windows7-x64
10source/Cov...v4.exe
windows10-2004-x64
10source/Cov...ry.exe
windows7-x64
10source/Cov...ry.exe
windows10-2004-x64
10source/Cov...en.exe
windows7-x64
3source/Cov...en.exe
windows10-2004-x64
3source/Cov...en.exe
windows7-x64
3source/Cov...en.exe
windows10-2004-x64
3source/Tro...29.bat
windows7-x64
10source/Tro...29.bat
windows10-2004-x64
10source/mbr.exe
windows7-x64
6source/mbr.exe
windows10-2004-x64
6Behavioral task
behavioral1
Sample
TrojanRansomCovid29.exe
Resource
win7-20240704-en
windows7-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
TrojanRansomCovid29.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral3
Sample
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
source/Bat To Exe Converter/help.chm
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
source/Bat To Exe Converter/help.chm
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
source/Cov29Cry.exe
Resource
win7-20240704-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral8
Sample
source/Cov29Cry.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral9
Sample
source/Cov29Cry/Chaos Ransomware Builder v4.exe
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
source/Cov29Cry/Chaos Ransomware Builder v4.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
source/Cov29Cry/Cov29Cry.exe
Resource
win7-20240705-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral12
Sample
source/Cov29Cry/Cov29Cry.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral13
Sample
source/Cov29LockScreen.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
source/Cov29LockScreen.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
source/Cov29LockScreen/Cov29LockScreen.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
source/Cov29LockScreen/Cov29LockScreen.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
source/TrojanRansomCovid29.bat
Resource
win7-20240729-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral18
Sample
source/TrojanRansomCovid29.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral19
Sample
source/mbr.exe
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
source/mbr.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Covid29 Ransomware.zip
- Size 1.7MB
- Sample240809-lx8bdayhpj
- SHA256 bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3
- MD5 272d3e458250acd2ea839eb24b427ce5
- SHA1 fae7194da5c969f2d8220ed9250aa1de7bf56609
- SHA512 d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c
- SSDEEP 49152:dSrGy+kXRl9cIXjRG8OzbgFSXACZ4UL238tvVZkKNDN0AaFlkUSan:OZlyIzRXOfZv4UrtvVZRW6i
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Chaos Ransomware 3 IoCs
resource yara_rule static1/unpack001/source/Cov29Cry.exe.death family_chaos static1/unpack001/source/Cov29Cry/Chaos Ransomware Builder v4.exe family_chaos static1/unpack001/source/Cov29Cry/Cov29Cry.exe.death family_chaos - Chaos family
-
resource yara_rule static1/unpack001/TrojanRansomCovid29.exe upx static1/unpack001/source/Bat To Exe Converter/Bat_To_Exe_Converter.exe upx - Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/TrojanRansomCovid29.exe unpack001/source/Bat To Exe Converter/Bat_To_Exe_Converter.exe unpack001/source/Cov29Cry.exe.death unpack001/source/Cov29Cry/Chaos Ransomware Builder v4.exe unpack001/source/Cov29Cry/Cov29Cry.exe.death unpack001/source/Cov29LockScreen.exe unpack001/source/Cov29LockScreen/Cov29LockScreen.exe unpack001/source/mbr.exe.danger
File Explorer
-
Covid29 Ransomware.zip.zip 1.7MB
-
TrojanRansomCovid29.exe.exe 542KB
-
readme.txt285B
-
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe.exe 444KB
-
source/Bat To Exe Converter/help.chm.chm 14KB
-
source/Bat To Exe Converter/settings.ini242B
-
source/Cov29Cry.exe.death.exe 103KB
-
source/Cov29Cry/AdvancedOptions.PNG.png 16KB
-
source/Cov29Cry/Chaos Ransomware Builder v4.exe.exe 550KB
-
source/Cov29Cry/Cov29Cry.exe.death.exe 103KB
-
source/Cov29Cry/FileExtentions.txt1KB
-
source/Cov29Cry/Options.PNG.png 47KB
-
source/Cov29Cry/bg.jpg.jpg 30KB
-
source/Cov29Cry/covid29-is-here.txt859B
-
source/Cov29LockScreen.exe.exe 48KB
-
source/Cov29LockScreen/23311_lores.jpg.jpg 30KB
-
source/Cov29LockScreen/Cov29LockScreen.exe.exe 48KB
-
source/Cov29LockScreen/Cov29LockScreen.vbp633B
-
source/Cov29LockScreen/Cov29LockScreen.vbw45B
-
source/Cov29LockScreen/Form1.frm1KB
-
source/Cov29LockScreen/Form1.frx30KB
-
source/TrojanRansomCovid29.bat1KB
-
source/icon.ico147KB
-
source/icon.jfif.jpg 8KB
-
source/mbr.cpp365B
-
source/mbr.exe.danger.exe 1.3MB
TrojanRansomCovid29.exe
- SHA256 a8054338891db7231f9885ca0d3bc90a651c63878ff603ede5c3efafa7e25254
- MD5 9f0563f2faaf6b9a0f7b3cf058ac80b6
- SHA1 244e0ff0a5366c1607f104e7e7af4949510226ec
- SHA512 40cdf4c754977e60c233417e42a62be02f9b5bfe239c0378664c28757ce6ce1fc3b91b83d6ef6bb184c4d831761f57a07255526d12a3a955c3b473bddb97f4c9
- SSDEEP 12288:xBv407Pg09KyclZbmoYsp8L/0C7Cvb3p62STTzfGGz9oSzrfI:xh5rgjycXbm0K/EzQl/xDrfI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1762080
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
392KB
Virtual Size
392KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
150KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
readme.txt
- SHA256 17976e8a6952b0123b729b50b3ad981cbe97083db9de66a37eb6f8decc39b76e
- MD5 f4f557db9c615c87e524802af8a9992f
- SHA1 692692c464b2a0229c697534c97d391179c5b646
- SHA512 7e8b9f2c01edf81252b722e2f9fffd1418150e9c5d6c322645bdc675561bad5b204c93ee5484b464c27a2d56ce86abc00152d32609bfd5f8271c32089b12d4c0
- MD5 SHA1 SHA512
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
- SHA256 7adc1f7ff040628a600f99465bd70e71ad83fecfe60b0f1dadc84b5d262ff350
- MD5 76d5900a4adf4c1f2ab8dbfd0a450c4a
- SHA1 6177a27416519564ecb5d38093d61c9a81d3c290
- SHA512 286b05ff09d4e85856c251d56902486738d9b2457d9a56ea8a449195b349f2718816099f4602efba88dad592dd6cecefcd0748382888c3026dd585b3e46f0c6e
- SSDEEP 12288:iYicHMPMDp8WrZtzlqQMB/FS/CiUF7RAfoSBjF:viuMPMDp8mtzbMFFS/CzKF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
968208
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
548KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
396KB
Virtual Size
400KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
source/Bat To Exe Converter/help.chm
- SHA256 00037bfc41afacf262afda160e17d3cca33606276324e99bbd93ad1207e9a7c0
- MD5 ffa8c49b21b077b0dc4b51a1f6f9a753
- SHA1 5fe5b4d96b266b29bd7aaf41b32394f58e7416e2
- SHA512 751eeaef0828ec4416569291ebf3f434208ff43405221339688ec2535cd5947d58ad4d2fd8ea073aa0554f712783f5ec8d5f42dfc4ee935d2905bc541ccd0a9b
- SSDEEP 192:TQ3bVqwNUWqaGA9yb6OmVbelnchhvm2I2S1O:TQLbNJqHA9YYVbCahvm280
- MD5 SHA1 SHA512 SSDEEP
source/Bat To Exe Converter/settings.ini
- SHA256 236d6136a9ea4241facb7c459bf0bad6d1fa572d436e6e73c44884d6126e5ab4
- MD5 d3be6c4edea45f5a9a766dd235e4c23a
- SHA1 bc3f164c51e8f9b223b2992688aae2d492a18353
- SHA512 bd2f5cb1316bcc64bbf30b2828d497157129e2013a529be591733a5c900f4d3450e97eed3ba75f057a49884cdb9c0a72dcc2ba5768db33fba7ce9236f5cea6bc
- MD5 SHA1 SHA512
source/Cov29Cry.exe.death
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a
- MD5 8bcd083e16af6c15e14520d5a0bd7e6a
- SHA1 c4d2f35d1fdb295db887f31bbc9237ac9263d782
- SHA512 35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a
- SSDEEP 3072:H3kyzZr9SE9RmXjSPjXvyT2cQf8WhjTRqvM:N1r9SELZDv25iVly
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
111326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
source/Cov29Cry/AdvancedOptions.PNG
- SHA256 6c9eb2da924df69bcee50c50f51a67c66321eaf1f453e4c864f037d31e08cf93
- MD5 c5f0f9ab684461c635f551d045e6caa5
- SHA1 d68eabb18c68f34abc7e91b8538c445738c619e1
- SHA512 f4ecaac100f6901dc1172fec228f48c5f73d828845dd579059143a0099ca3f5df17789808953b4145d236470acde80811d9c7e89b05dd773e9c2bdcf6142df42
- SSDEEP 384:xaeNJkobdwg/PB9IpD0xt7ZLyV2EvpNm9du6TX15fT5Vj77tnMhn:xtJXdwGHFt1yDCLvX15fT377KJ
- MD5 SHA1 SHA512 SSDEEP
source/Cov29Cry/Chaos Ransomware Builder v4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77
- MD5 8b855e56e41a6e10d28522a20c1e0341
- SHA1 17ea75272cfe3749c6727388fd444d2c970f9d01
- SHA512 eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908
- SSDEEP 3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
447918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\User\Desktop\builder\CustomWindowsForm\obj\Debug\Chaos Ransomware Builder v4.pdb
mscoree
_CorExeMain
Name
.text
Size
429KB
Virtual Size
429KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
source/Cov29Cry/Cov29Cry.exe.death
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a
- MD5 8bcd083e16af6c15e14520d5a0bd7e6a
- SHA1 c4d2f35d1fdb295db887f31bbc9237ac9263d782
- SHA512 35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a
- SSDEEP 3072:H3kyzZr9SE9RmXjSPjXvyT2cQf8WhjTRqvM:N1r9SELZDv25iVly
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
111326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
source/Cov29Cry/FileExtentions.txt
- SHA256 31fd1820ee3f7aad61f1f99e944d2df2c5406f033a661ea98e07c389d6334ba2
- MD5 189eeecf41700ae5ba9ae1a4a1c49e9a
- SHA1 79dbd0e112eb3a184643dc4d9b76356c272fbc6b
- SHA512 37973f4103ee102d0fdb1e1d6a820be41305dec6293d6d73b55cf34852533392e5aa5c38fd6ed7554fbfca7790e2670d0799774ad64e23c816a48592f623be5f
- MD5 SHA1 SHA512
source/Cov29Cry/Options.PNG
- SHA256 7b288d1ad9b942447462f51c72fd30e050934240e9f5efa85e73f4f64c3ac1a9
- MD5 cdd3a90a2f2ab81410f356dcb38fc17b
- SHA1 66c451a8cad0def71e1216e66741c79e908c3304
- SHA512 90018991d0127a434758d37d41afa047b47493c4a7d503a8c185e569b52ebf3f10b1f899021c946bf599f623db2f6e11f0765f574573ad55fbfc86c776ca3928
- SSDEEP 768:mU3R21KunK9evX2uiTYb5a4Iu3geHYeP3aFH6ERIBNhfMpnxx6UJ:mU3k1ZX2utnROINf6bRJ
- MD5 SHA1 SHA512 SSDEEP
source/Cov29Cry/bg.jpg
- SHA256 741d2576009640a47733a6c724d56ed1a9cee1014cde047b9384181a1758cd34
- MD5 108fc794e7171419cf881b4058f88d20
- SHA1 dd05defd9fe5fb103db09eb2a3bb72c5ed7d8777
- SHA512 3a1a22217ff636e48612ff3b55ac6611eda6ae0b5a1f4d693440cbd6aef84d6657d3cd076ca828ba828ee556ab64e5bdecb37c1d682590877f3b23345baeb0ea
- SSDEEP 768:VjjisU9FR4GNO9OCo0/E9bx0MpO5oO4A2K8iYB7:Vjjiz9FCrTGfmoOTrU
- MD5 SHA1 SHA512 SSDEEP
source/Cov29Cry/covid29-is-here.txt
- SHA256 be6d0b63a86a838d3252ce3ef015029499af4e9f0f8a0e04062f096368b58b8a
- MD5 0a9f7b91e7c6beac740c17951e7feecb
- SHA1 82546b0a0d2cf5461c492e4d51767d06a1355440
- SHA512 04dcea6aca102d9780dcad7f56fd560fd325fe0b9c3483fc16b88b163221d9ed36c99fee65bfb9ab151dfef092445c8241a36e4bb4bbdeff7098ac508a18b220
- MD5 SHA1 SHA512
source/Cov29LockScreen.exe
- IMPHASH 2cdb5118ade9e194fb3c02df82290ccf
- SHA256 6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c
- MD5 f724c6da46dc54e6737db821f9b62d77
- SHA1 e35d5587326c61f4d7abd75f2f0fc1251b961977
- SHA512 6f83dd7821828771a9cae34881c611522f6b5a567f5832f9e4b9b4b59bf495f40ad78678bd86cba59d32ea8644b4aa5f052552774fea142b9d6da625b55b6afc
- SSDEEP 768:/PjjisU9FR4GNO9OCo0/E9bx0MpO5oO4A2K8iYBo:/Pjjiz9FCrTGfmoOTrD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4428
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
_adj_fdiv_m32
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarDup
_CIatan
_allmul
_CItan
_CIexp
Name
.text
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=1, id=9, version=8041,
count=1, id=13, version=8169,
source/Cov29LockScreen/23311_lores.jpg
- SHA256 741d2576009640a47733a6c724d56ed1a9cee1014cde047b9384181a1758cd34
- MD5 108fc794e7171419cf881b4058f88d20
- SHA1 dd05defd9fe5fb103db09eb2a3bb72c5ed7d8777
- SHA512 3a1a22217ff636e48612ff3b55ac6611eda6ae0b5a1f4d693440cbd6aef84d6657d3cd076ca828ba828ee556ab64e5bdecb37c1d682590877f3b23345baeb0ea
- SSDEEP 768:VjjisU9FR4GNO9OCo0/E9bx0MpO5oO4A2K8iYB7:Vjjiz9FCrTGfmoOTrU
- MD5 SHA1 SHA512 SSDEEP
source/Cov29LockScreen/Cov29LockScreen.exe
- IMPHASH 2cdb5118ade9e194fb3c02df82290ccf
- SHA256 6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c
- MD5 f724c6da46dc54e6737db821f9b62d77
- SHA1 e35d5587326c61f4d7abd75f2f0fc1251b961977
- SHA512 6f83dd7821828771a9cae34881c611522f6b5a567f5832f9e4b9b4b59bf495f40ad78678bd86cba59d32ea8644b4aa5f052552774fea142b9d6da625b55b6afc
- SSDEEP 768:/PjjisU9FR4GNO9OCo0/E9bx0MpO5oO4A2K8iYBo:/Pjjiz9FCrTGfmoOTrD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4428
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
_adj_fdiv_m32
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarDup
_CIatan
_allmul
_CItan
_CIexp
Name
.text
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=1, id=9, version=8041,
count=1, id=13, version=8169,
source/Cov29LockScreen/Cov29LockScreen.vbp
- SHA256 7008899f61b246889060a2032dbf812ea579f147880ab8f0ae7db67729d61090
- MD5 420983daadcf363dee597da26732659d
- SHA1 501a4e5714e301361aad8c3ea8c5861111956478
- SHA512 98f7026010d089fc74b0edf6756d7280aa03ab82a5c10ee7848d82d81fae6f9df23569615ac32b816e550219b761d450185e66d688eb498cd855915927eb3e49
- MD5 SHA1 SHA512
source/Cov29LockScreen/Cov29LockScreen.vbw
- SHA256 aa198998686412f07e422127bb3f4a1a1228ce62204fc8f5a43bd6863121de65
- MD5 4bc79d0f731d9f8a6a7648f3f8c7b2ed
- SHA1 e1f4ab69a394f78de0633ed8b542e4f98e3b1458
- SHA512 959c87b708ba8ddad4252a35258733c07f1fc1421e7f90abe01dae52d6455303b10c420074bb409ffd7a54617b9a222e7939d511d807f012fc72c0b6c1751d94
- MD5 SHA1 SHA512
source/Cov29LockScreen/Form1.frm
- SHA256 b1c2c1a22a0081fc23b8c9298ef088b0055b9f12a57b501450cd2b282561e784
- MD5 7bc02ce2aa937dc58733a326b6d6df4e
- SHA1 b86ff7bc9619fa720629ded50bef86eb23f66b0e
- SHA512 232cae0a89c81ed31225a959562b86b67ca7c4e47bbafb2135e39962b85f18aa9f36a2342094eba48b5c4ea2018d5457f1a90054a27a4325f42d7ef811e46905
- MD5 SHA1 SHA512
source/Cov29LockScreen/Form1.frx
- SHA256 458f33b650a04abbb49bda25ae5a2d7cee6ae26f6450a061c5e8012ab9af16d0
- MD5 654d48ddcf505d1b7c31817d9b8a91f2
- SHA1 3830a65ebbf9bb716fbd99da06eddc1da8f2bd54
- SHA512 7db2fdd00f7deba41e396ee83016621a7937e7438f4e4aa68045c1b7871c0601ad503f926fde054071aa97cd616ff8aadf4b73a09d50eba9e53e82da0e17e0c8
- SSDEEP 768:ZjjisU9FR4GNO9OCo0/E9bx0MpO5oO4A2K8iYB7:Zjjiz9FCrTGfmoOTrU
- MD5 SHA1 SHA512 SSDEEP
source/TrojanRansomCovid29.bat
- SHA256 b82e64e533789c639d8e193b78e06fc028ea227f55d7568865120be080179afc
- MD5 57f0432c8e31d4ff4da7962db27ef4e8
- SHA1 d5023b3123c0b7fae683588ac0480cd2731a0c5e
- SHA512 bc082486503a95f8e2ce7689d31423386a03054c5e8e20e61250ca7b7a701e98489f5932eba4837e05ec935057f18633798a10f6f84573a95fcf086ee7cabcbf
- MD5 SHA1 SHA512
source/icon.ico
- SHA256 930ab1d5fcd9864c45ad88911b2b13d84b379d0081dbfa114089eb4750c7d04f
- MD5 c2c802b751e5a25b524b9369f583c371
- SHA1 eaa3ed8f1c656c3ffb0a434241e65f2dd181ba4d
- SHA512 72716b0c22b82ae3e38e21ad8fbc3c738da8bd3ac437e6ca0b022e0094c1d13a2f65f61e6a5c7fad6ee3fc6240990caa73cd8b0e53cf330a655457c6a2b0c37c
- SSDEEP 1536:V/6qKJHV8vj9bPnNfTiReHBX5UtrODdbM9kkDyTTwZglEMWpPDelGGKHgXs3:CqNTiCBpoiDdbM9kkmTTwFTAV
- MD5 SHA1 SHA512 SSDEEP
source/icon.jfif
- SHA256 ea253bacafd64a86055f8779f96d71801ed171a25e6027f7f0565dcb05bfe1b1
- MD5 a09e22b372ad74b3a504798b7d3f87b0
- SHA1 3536de7ec5055eeeb7e4761ae4f8f624dc4dc436
- SHA512 829316d6e7dab8b0fc7a5e006d22e284f136b5db19565c5cfc4c0b17abd85c5155acc2dfb64f02fec07c6d5fd59530feb6644b67499e024cd234cb4996d0a1bf
- SSDEEP 192:6grmvvWkxFC6jpnDA2elpwYnxjhxK6TH41T7OSuf1sdCG:JmHBxFCyTImYnNTYRFuKd7
- MD5 SHA1 SHA512 SSDEEP
source/mbr.cpp
- SHA256 45eaa30a90c739fd9fb32d59b29d3e7cd8871431670a3e64d6c34fd53a08f979
- MD5 d20eddecb5625b60d61d80c067537188
- SHA1 8418cb3dd155a9399e7be92da3b4fcd50b559f99
- SHA512 a0f1578adbabaa0cd5567678ac382637ea078070ef7f567251374ff7f1d1e3e2c6d108471a0cd6aeeb47058d06e0c2bafd0e8f487be04208e44311e478c1f980
- MD5 SHA1 SHA512
source/mbr.exe.danger
- IMPHASH 0341b2251534bec6e436b281a0639ffe
- SHA256 9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e
- MD5 35af6068d91ba1cc6ce21b461f242f94
- SHA1 cb054789ff03aa1617a6f5741ad53e4598184ffa
- SHA512 136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169
- SSDEEP 24576:LT3LlvRiQNGYXCI+b1w30WgvZef6YhuQ5O3h3JMtbu:7XNGDIu8NyMtbu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
AddAtomA
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindAtomA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
QueryPerformanceCounter
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetCriticalSectionSpinCount
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_errno
_fdopen
_filelengthi64
_fileno
_fileno
_fmode
_fstat64
_ftime
_initterm
_iob
_lock
_lseeki64
_onexit
_read
_setjmp3
_strnicmp
_unlock
_write
_write
abort
atoi
calloc
exit
fclose
fflush
fgetpos
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
isspace
iswctype
localeconv
longjmp
malloc
memchr
memcmp
memmove
printf
putc
putwc
realloc
setlocale
setvbuf
signal
sprintf
strchr
strcmp
strcoll
strerror
strftime
strncmp
strxfrm
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm
ntdll
memcpy
memset
strlen
Name
.text
Size
512KB
Virtual Size
511KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
116KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ