Overview

overview

9

Static

static

3

host.bin.exe

windows7-x64

9

host.bin.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    host.bin.exe

  • Size

    16KB

  • Sample

    240818-ll2z8axelg

  • MD5

    407318721d5587b5db6ce7873890db96

  • SHA1

    87e69c62e196961f51b3a973a6b7e810dcb922c9

  • SHA256

    c641e79ae3fa662a639f4fa3a0cb8723030c114bfb2d7ffad488de73afd574ce

  • SHA512

    2dfa2e3c1ad5ba3e4dd81bfd646995fdcdc20c1080974a26cd01254506ba32d394693144758cf71bdc5726b71aa7721551ecea4f0bd8ca2ccffc17a837ff6f74

  • SSDEEP

    384:y0sAA+LPsuTnVshZ9hA+b3Qj5MRjV1V/QBOIjLb1:yaV/+b3N31V/yb

Score
9/10
discoveryransomware

Malware Config

Targets

    • Target

      host.bin.exe

    • Size

      16KB

    • MD5

      407318721d5587b5db6ce7873890db96

    • SHA1

      87e69c62e196961f51b3a973a6b7e810dcb922c9

    • SHA256

      c641e79ae3fa662a639f4fa3a0cb8723030c114bfb2d7ffad488de73afd574ce

    • SHA512

      2dfa2e3c1ad5ba3e4dd81bfd646995fdcdc20c1080974a26cd01254506ba32d394693144758cf71bdc5726b71aa7721551ecea4f0bd8ca2ccffc17a837ff6f74

    • SSDEEP

      384:y0sAA+LPsuTnVshZ9hA+b3Qj5MRjV1V/QBOIjLb1:yaV/+b3N31V/yb

    Score
    9/10
    discoveryransomware

    • Renames multiple (1004) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks