cryptolocker

General

Target

image_2024-08-15_173644456.png
Size

65KB
Sample

240816-aybs1svdka
MD5

094782933a1b323b806d38e2163c514f
SHA1

c8686351f07d316c55e98a4db19b494ee761cc15
SHA256

339cf3a00a96168c86ffabb23d2dcec68bb93f4693a0ed9fd22c30ab920395e2
SHA512

9e70ed9461ae64995290e3d3a06a07de533fbe01aef1b4fe391cacf6e4638248810722d14d32d366437121b5ed0baa727741c97d08a456e263735b3921b286ea
SSDEEP

1536:Enq5ZwSrulPtZdenS9KGw0ALVCDGp7jdo00cjUl9elOtHNof:Eq7wECJkJvFomQ8wtHy

Score

10^/10

Malware Config

Targets

- Target
  
  image_2024-08-15_173644456.png
- Size
  
  65KB
- MD5
  
  094782933a1b323b806d38e2163c514f
- SHA1
  
  c8686351f07d316c55e98a4db19b494ee761cc15
- SHA256
  
  339cf3a00a96168c86ffabb23d2dcec68bb93f4693a0ed9fd22c30ab920395e2
- SHA512
  
  9e70ed9461ae64995290e3d3a06a07de533fbe01aef1b4fe391cacf6e4638248810722d14d32d366437121b5ed0baa727741c97d08a456e263735b3921b286ea
- SSDEEP
  
  1536:Enq5ZwSrulPtZdenS9KGw0ALVCDGp7jdo00cjUl9elOtHNof:Eq7wECJkJvFomQ8wtHy
Score

10^/10

cryptolocker troldesh defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan upx
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
behavioral1