General

  • Target

    cd1ddf5224aba06ccbdfa0c637012c59411bd3808f940666211a39778eab9906

  • Size

    75KB

  • Sample

    240903-l5c57stekk

  • MD5

    80b2d3e94aeb3b197382a559740df6e1

  • SHA1

    c665d66e60e42a4413668ea6584804b90f7c3eb0

  • SHA256

    cd1ddf5224aba06ccbdfa0c637012c59411bd3808f940666211a39778eab9906

  • SHA512

    16a8fcf44f7e24a1f0f11bc5e19bb19b3392527589807f255445e4493dac4c9afa799dfdc52cece4465a4d2b022777d754638ca8def4caaee967cc617ed926d8

  • SSDEEP

    1536:CTW7JJ7Tx4PN54PNLTW7JJ7Tx4PN54PN6pA:hEWqEWL

Malware Config

Targets

    • Target

      cd1ddf5224aba06ccbdfa0c637012c59411bd3808f940666211a39778eab9906

    • Size

      75KB

    • MD5

      80b2d3e94aeb3b197382a559740df6e1

    • SHA1

      c665d66e60e42a4413668ea6584804b90f7c3eb0

    • SHA256

      cd1ddf5224aba06ccbdfa0c637012c59411bd3808f940666211a39778eab9906

    • SHA512

      16a8fcf44f7e24a1f0f11bc5e19bb19b3392527589807f255445e4493dac4c9afa799dfdc52cece4465a4d2b022777d754638ca8def4caaee967cc617ed926d8

    • SSDEEP

      1536:CTW7JJ7Tx4PN54PNLTW7JJ7Tx4PN54PN6pA:hEWqEWL

    • Renames multiple (4108) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks