Extracted

Extracted

Extracted

Extracted

• • Target
    RNSM00280.7z
  • Size 4.7MB
  • SHA256 1ec18abdb330ff2eb70bf897b7363e5c68505f9fa3fbc151d21aff89736874fa
  • MD5 b48f8458bdb951ccda3b160b14b66f58
  • SHA1 06fa206e5f66f2690fb7752b34bf5201549ff509
  • SHA512 7c103b393a5aeff71d41b5203faa4c6f83f89f39d1da97782c0a3b3cd40cb77d7ffce5cf8f88f2120e3c7194714398f0a5688ab3c21a68f314d036f65294127a
  • SSDEEP 98304:coRmKVszuiggNjp+D3RAfkb5N1JZubwTHZH/8NXpe7udFjts3c:lRnaz4qMREkb5N1JA8DlZ6dFjtP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cerbercybergatelockylocky_osiristeslacrypttroldeshdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanupx

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber

  • Cerber family

    cerber

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky

  • Locky (Osiris variant)

    Variant of the Locky ransomware seen in the wild since early 2017.

    ransomwarelocky_osiris

  • Locky family

    locky

  • Locky_osiris family

    locky_osiris

  • Modifies WinLogon for persistence

    persistence

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt

  • Teslacrypt family

    teslacrypt

  • Troldesh family

    troldesh

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Renames multiple (305) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Contacts a large (1127) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1