General

  • Target

    2024-11-15_1b7d59c24815f7a88823f559b851ca56_virlock

  • Size

    564KB

  • Sample

    241115-b882yawgqn

  • MD5

    1b7d59c24815f7a88823f559b851ca56

  • SHA1

    cf93b14230e29c1a7c1cd068540b7eb656895d5e

  • SHA256

    11b644c3dd04054c9b1cb898fd2d55ba581ece8e8cfb79d481a7cbcbe8ba44b6

  • SHA512

    206811525ffdbf289096709fc59a2b7118b76d108bf7356de5dd0ab3f75476dfa39705e7684cd65147498ca2249298963594c2d3b9d880b083ed4dce747c41c4

  • SSDEEP

    12288:ziNCJjuttzfEBnfcGmzPU0y5j9f0mVYwczKbrx:zawjuw9GkPpczE

Malware Config

Targets

    • Target

      2024-11-15_1b7d59c24815f7a88823f559b851ca56_virlock

    • Size

      564KB

    • MD5

      1b7d59c24815f7a88823f559b851ca56

    • SHA1

      cf93b14230e29c1a7c1cd068540b7eb656895d5e

    • SHA256

      11b644c3dd04054c9b1cb898fd2d55ba581ece8e8cfb79d481a7cbcbe8ba44b6

    • SHA512

      206811525ffdbf289096709fc59a2b7118b76d108bf7356de5dd0ab3f75476dfa39705e7684cd65147498ca2249298963594c2d3b9d880b083ed4dce747c41c4

    • SSDEEP

      12288:ziNCJjuttzfEBnfcGmzPU0y5j9f0mVYwczKbrx:zawjuw9GkPpczE

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks