Overview
overview
8Static
static
3Clumsy0.4v...v3.exe
windows7-x64
7Clumsy0.4v...v3.exe
windows10-2004-x64
8܅�� zF.pyc
windows7-x64
܅�� zF.pyc
windows10-2004-x64
Clumsy0.4v....4.txt
windows7-x64
1Clumsy0.4v....4.txt
windows10-2004-x64
1Clumsy0.4v...rt.dll
windows7-x64
1Clumsy0.4v...rt.dll
windows10-2004-x64
1Clumsy0.4v...64.sys
windows7-x64
1Clumsy0.4v...64.sys
windows10-2004-x64
1Clumsy0.4v...ig.txt
windows7-x64
1Clumsy0.4v...ig.txt
windows10-2004-x64
1Analysis
-
max time kernel
1561s -
max time network
1562s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
Clumsy0.4v3/Clumsy0.4v3.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Clumsy0.4v3/Clumsy0.4v3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
܅�� zF.pyc
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
܅�� zF.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Clumsy0.4v3/READ ABOUT UPGRADES FOR 0.4.txt
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Clumsy0.4v3/READ ABOUT UPGRADES FOR 0.4.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Clumsy0.4v3/WinDivert.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Clumsy0.4v3/WinDivert.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Clumsy0.4v3/WinDivert64.sys
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Clumsy0.4v3/WinDivert64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Clumsy0.4v3/config.txt
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
Clumsy0.4v3/config.txt
Resource
win10v2004-20241007-en
General
-
Target
Clumsy0.4v3/READ ABOUT UPGRADES FOR 0.4.txt
-
Size
6KB
-
MD5
2cfa5b3d8ba0c0d8d4e7be670d8e3fa4
-
SHA1
169656d2233c9ca02569e2a26a5051ac5df5740f
-
SHA256
6220d2d0fc51a57072cc3e4243fbcb0fc901fe0d1fb17ee31cec8fe564d49d55
-
SHA512
f51a2a32b0bfab28fbca0b17eb33ee57af95c90bbc45408297d3b16c78ded2a68b822239142f7b5e53a4555443635cf924d0cfa9008afc5a02983e9a06763e56
-
SSDEEP
48:w/MMMMMMMMMMMMjMMMMjMMMMhMMMMjMMMMhMMMMjMMMMMMMMMMMMjMMMMMMhMMML:w3H/8
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2124 NOTEPAD.EXE