Behavioral task
behavioral1
Sample
2024-09-24_1f133d844f92836486b3bfd761873260_get2_snake.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-24_1f133d844f92836486b3bfd761873260_get2_snake.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-24_1f133d844f92836486b3bfd761873260_get2_snake
-
Size
2.4MB
-
MD5
1f133d844f92836486b3bfd761873260
-
SHA1
dc65b35fa222ed77d75153d89ce2200538faef8c
-
SHA256
c612cf11cffd466b7d2d137b5381a55715221ac6a4d229054e66a81549330604
-
SHA512
cbc1689cb9be368c3800df3222379ef0ed01f25a3e37fd72a840e8f8bdd3a76dff69910b818a753f40d8e369b16571e355622aa89f72e7f0dd440aa2f263efde
-
SSDEEP
24576:vvw+u2yJ31l7aHxFw3HjPZIMNxD+41wysXlE:vvwsGraH3w3LdSysXlE
Malware Config
Signatures
-
Detected LegionLocker ransomware 1 IoCs
Sample contains strings associated with the LegionLocker family.
Processes:
resource yara_rule sample family_legionlocker -
Legionlocker family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-09-24_1f133d844f92836486b3bfd761873260_get2_snake
Files
-
2024-09-24_1f133d844f92836486b3bfd761873260_get2_snake.exe windows:0 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ