99e387e8ffc1c7a7eea7e87ea7b5c04b6120c9ab66c31484c5e97f54874f4495 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Trojan.Win32.Zombie.rfn-99e387e8ffc1c7a7eea7e87ea7b5c04b6120c9ab66c31484c5e97f54874f4495N
Size

42KB
Sample

240921-vdvqlstarj
MD5

91d50f7013eaa25786a6bb2088711930
SHA1

ec6c9e9b09709e968c30fa3567e5e3c7b1aee8f9
SHA256

99e387e8ffc1c7a7eea7e87ea7b5c04b6120c9ab66c31484c5e97f54874f4495
SHA512

16d5941df1d88ecd964da7eb02e004ee86f12822ab53ab875e537658bdad0804dee621ed2d882885a9e3316b5904b38fb7cbaaaf62164177731421c67831f1df
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1VnfoT:W7ZppApBULcfpHLcfpSo3fnnfoT

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  Trojan.Win32.Zombie.rfn-99e387e8ffc1c7a7eea7e87ea7b5c04b6120c9ab66c31484c5e97f54874f4495N
- Size
  
  42KB
- MD5
  
  91d50f7013eaa25786a6bb2088711930
- SHA1
  
  ec6c9e9b09709e968c30fa3567e5e3c7b1aee8f9
- SHA256
  
  99e387e8ffc1c7a7eea7e87ea7b5c04b6120c9ab66c31484c5e97f54874f4495
- SHA512
  
  16d5941df1d88ecd964da7eb02e004ee86f12822ab53ab875e537658bdad0804dee621ed2d882885a9e3316b5904b38fb7cbaaaf62164177731421c67831f1df
- SSDEEP
  
  768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1VnfoT:W7ZppApBULcfpHLcfpSo3fnnfoT
Score

9^/10

discovery ransomware
- Renames multiple (3181) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware