General
- Target malware.zip
- Size 121KB
- Sample240913-ragg2atdnf
- SHA256 98e0c1e5d2e8e25ff99029d2f76a45a1b320c8cf3349df45d02dcd4070c0f49f
- MD5 abaf4783b0757ec06b31251e980a1eaa
- SHA1 40b6f277c5d8c50d5e8007b498a92c2ff73b8029
- SHA512 74933dfa0a0cc46a40a71efdf30e57848d1130cbf00b44bd77bd58458d671d03916b1432bb2b062f9d076390283da7f89e4680fd7c32ea6f60be0533e6bd42b8
- SSDEEP 3072:+iRgX3TJXl/CvZmnm/S0kXIj4rq5rbSC4bpsFUUR28VfS:PWX3TJXsom/SVSGqvhc8tS
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
locky sample/document_copy.js
Resource
win7-20240729-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
locky sample/document_copy.js
Resource
win10v2004-20240802-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
locky sample/document_copy_payload.exe
Resource
win7-20240903-en
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
locky sample/document_copy_payload.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
sample2/invoice.js
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
sample2/invoice.js
Resource
win10v2004-20240802-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target locky sample/document_copy.js
- Size 5KB
- SHA256 23e0e6edffc78a82ccef3cb055fda745013fde6feee5356f94715f41b2640453
- MD5 5e13c906031221b202a833300d8a28b0
- SHA1 72dea769a852776c87737bca07d4b8a4effa1af2
- SHA512 793075b0f7e23686744730a3a580dc9429d3477334c708881189cc60329a70aaacd422569cd8be1bae0efe8f5875e348077da0f30c7e5aee21b4ca7bbaa59006
- SSDEEP 96:OmMfGfr/O+hD6VxDNi4VHTBibX3CGKH8oCQaNwDgKM:OX+fr/O5VdI4VGX3CGKc+aaD0
- MD5 SHA1 SHA512 SSDEEP
Score8/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target locky sample/document_copy_payload.exe
- Size 151KB
- SHA256 d5c93927b531e8629898b31e277034c0802befa26ffe66ed3df96d25282fc408
- MD5 f2675f682e00488c346924d2fbec10eb
- SHA1 1a8588c8e1be08f72804ae3a4e0a34b1b492ad79
- SHA512 8218839e91aeb68f12dc7f2cfbe431ace4d444e033a8f8300413297e5fd9d78e752576bb77415005051a08ddb0ea355d707e2be3b1b92faa2fa000fe6e182338
- SSDEEP 3072:ebnZrimJ3dTNIj9dRR34lc3Stj0tVfNNMa1:ez9nJzIZzRIG0iVfX
- MD5 SHA1 SHA512 SSDEEP
Score3/10 -
- Target sample2/invoice.js
- Size 1KB
- SHA256 ff55d814dc8e36e2e43686d8f02fed61df15d55f03f1d27ea71bd5382c4c8d4f
- MD5 d1850f9c0977aca01f62f4426422eef2
- SHA1 ed439b57cc963220f32b8b9ff26ffb13c8cb0617
- SHA512 9d1d42987dda2df541bcd3fb59c614bd32260be2d16512e7816473b748a0f40f282b778211134dbc6432b16cab59b2164a7f95fa455dc8c536526ed115fbfcf9
- MD5 SHA1 SHA512
Score8/10-
Blocklisted process makes network request