cryptolocker

Sharing

Copy URL Twitter E-mail

General

Target
Batch_11.zip
Size 3.9MB
Sample241122-d88saazlhm
SHA256 f6a83e6ed8bf92b8ff4da0aba72fe354199ec79a99008b34800e4cfdb92d3a67
MD5 d9efba6b5d8f5cadcb5b72a261364879
SHA1 847e175e807b9f271cfecdf0b451d029bdf73d5a
SHA512 ed9ae302a89f3aea8f749e804ed6b058f7d4a48e39ac3ef7d5d8e28eebbbe8a35f9ce7b7675ed57c968eade8ec29580cf37ac85f9aee9c56595b1662e6acaa60
SSDEEP 98304:ywQRPA4p9xWgZgAAqLIld4nSUYuNmH6z3rcq/fsQ:yTST47mW7c4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  VSNKLGuzoFJgFHyEI15w (2).exe
- Size 357KB
- SHA256 c8400b635f1b14bef0135631f05ae408bf551dac45fb23c1b26e20d60ea00f08
- MD5 89e1efdc766e9c7d41305566993ba800
- SHA1 be06191ebb3c96fcf5a87a1d3442ddfb3f19edfb
- SHA512 26f395abc7cb6a6e156f8d91e3b05756e9d98e45f91ad0cce9825404120888d842319b584a3898752fdd126057e511a8f46c37a640dd5fa02aa3d80462fdea63
- SSDEEP 6144:H+dE6vqOE9Z8LapTWgK/W9uAExjAhQiM5bQCdf/ORqz9BLp5hjoLxqZ:H+vvbGlpoAExjAYbQCdf/ORqZBdfjoLW
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1
- Target
  VSNKLGuzoFJgFHyEI15w.exe
- Size 357KB
- SHA256 c8400b635f1b14bef0135631f05ae408bf551dac45fb23c1b26e20d60ea00f08
- MD5 89e1efdc766e9c7d41305566993ba800
- SHA1 be06191ebb3c96fcf5a87a1d3442ddfb3f19edfb
- SHA512 26f395abc7cb6a6e156f8d91e3b05756e9d98e45f91ad0cce9825404120888d842319b584a3898752fdd126057e511a8f46c37a640dd5fa02aa3d80462fdea63
- SSDEEP 6144:H+dE6vqOE9Z8LapTWgK/W9uAExjAhQiM5bQCdf/ORqz9BLp5hjoLxqZ:H+vvbGlpoAExjAYbQCdf/ORqZBdfjoLW
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral2
- Target
  VideoCodeCX.exe
- Size 2.0MB
- SHA256 22b1af46ce7b3db0ec037026e035b0b09a6c791e5fb5fcb5e6ee3ef8d276abe1
- MD5 0701e045db5d20c93427b4bb452bc341
- SHA1 6be9df576ebfed1b2a0b14f2352dceaa36a10c79
- SHA512 40a542dbd44eab6c2f8f6631487be2065692489040632916aaee2d7f24810e4844291b1e6a0e5884362a7ebc534a03a44103465cd1266439107fc5c070c50dfb
- SSDEEP 49152:EkAG2QGTC5xvMdgpdb1KRzGepUu2cGbq7oc+tuNAn:EkAjQGTCnvMmpEQqUPn
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  WcsPlugInService.ex.exe
- Size 113KB
- SHA256 8f0c20eab317c9416ad6dd602013528dca8ee1467b111019fe6704ff8da6a241
- MD5 f9a974c8ed6793c226101c10af7542db
- SHA1 5719e5b45721af9ac9652332f2001d984e1d9a45
- SHA512 1f00ca5c9fdb1ca8fe6d9b9728da6b3aac57b72e17e528ec37e77cdf6ae1cd52384b0ae8256e2f74f88ba87c9e90c575a0a8ebf729f894590fe71d5e6ce608d3
- SSDEEP 3072:pxuZMpyk7A79E6rdAXpRCxv/sqJ5SjTOaiZl7ObWlx+T:pYf79JAXKxHs0S3OaiZ1Oiv
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4
- Target
  WinLocker Builder.exe
- Size 317KB
- SHA256 3def8e9db50996046391a345099f3f7b023f8e0e26356702f73743e25d5716f8
- MD5 10bc8a66ffe85a5eb04d5dd463204318
- SHA1 e0df54485e4fba5af4ff0a61c022f794a5ba25d1
- SHA512 3d833e8083cb4e781b7572eedc89d4c94ea91a04a77f0e7727ff8bb4d16bb8887c19b6a2470e90a2cf714bdf72d26679075f7c7f4127e1c504182955808b99e8
- SSDEEP 6144:eUKmfbTAYbMLaOphVx4bu9xJjF1031CP82ooSaYq:eUvfHfMLaOpXKbOjj/sNLoSbq
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5
- Target
  WinLocker_Builder.exe
- Size 314KB
- SHA256 cfa91ed5fa38bc5e369b4bf4d59030be432d47b8e2f7e58b9f25c3c034654cc1
- MD5 d010491f999105e40f8550bd9daa4fa7
- SHA1 75f413c324f4b61a524c5330f17cd44019663544
- SHA512 a01eec4d45c9e27a4e138941851eacaa2c865d27c7d83ce94225a98dd3f80cd4576b5e9738a5d3637084443691a8bb72812c63daddbf098c0d69de92c928c669
- SSDEEP 6144:eH7QBEVURAirobeZq26b0FmS3utXig+vQeWXKjkQwLEaoS/V:BBEuR42q26AFmSetX+Qt6LuToS/V
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6
- Target
  _003E0000.exe.vir.exe
- Size 116KB
- SHA256 878304de96556ed340f190a9d8b5650dc71512eed4210676560fc41e7ac4857c
- MD5 f57d188c4667fab46208396af20badd2
- SHA1 367ea268c494d17672ef371adebef0f505c1a804
- SHA512 157615951ccf90c69aaa4e4e1e1f664ffcb6c5817371143ac5bc2dfac04185e57981d50194ad4a1784c29f16211b6a18e9fa085721d05e29ba63377e40dc41a2
- SSDEEP 3072:SsB0ura/QOVLLkeyYP1RNDZyuubclhZUnr:Sef7wkey21flyu8+i
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

defense_evasion discovery execution impact persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Drops startup file
- Adds Run key to start application
  persistence
behavioral7
- Target
  vmem02.exe
- Size 36KB
- SHA256 16e42d3e4af4d7de0bc9adfc317a68fffa41feb406e82d870bff657a86ab448e
- MD5 ceca6f5828b79d4da88523c4c30d890d
- SHA1 3a9197e2105200b5756e3428e7ca4f5dd2b6df23
- SHA512 5448036fc6a88d1e6797cb194007327d7f263c8254c0a6463025fc4da1d08fb637ae033aa7da6e6c7f5dfd95aed029ce03c3e0df362f71a0becefe20f58957b2
- SSDEEP 768:FtGLOTlOw4qwau28gJV6eRf130SngnM1RLNen+l3:wO5x7waQPeRt3BngMHU+J
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral8
- Target
  w8i9eHkHOwWwQlX.exe
- Size 1.3MB
- SHA256 7910428acb8eb014340219f413e4fcaab9bd31f9664e644fe91dacda9e65470d
- MD5 6ec6069728a91a04407283bc6bf208b7
- SHA1 5407241081ab23a29acafe11187bc118abdc15b0
- SHA512 bb809949f9305d4eed3becd28a254dc0eda7eea925a10548e6e560826ac22c51508a1ef9c9443e3690f98693b9775d238781392c16a0ca27301b5a1880913487
- SSDEEP 24576:q9WQitvyUilzOUxaOWk01G4fbu/F41jen6KXYzkEEknJS7DFN4L3GmPA705sCvsF:q9WDAUozOUxaOyGau6I6WPDvlAAoefk1
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral9
- Target
  wpbt0.dll
- Size 50KB
- SHA256 9282cdf4c83b4ca8015b0e450ac68c5bb7effe4503d3d34efa2ad496d37d2d26
- MD5 df9188698b078a38b399a8b6f61f9c34
- SHA1 b221335078e9e368f07b102fccab2c83c4f90a5f
- SHA512 97242771d5c9f864d6f929c141085c718da9642777778228e3a2b072c2137467c6b80fc8c0d439cc5aac0e434a5e6cef13b22b537ab52812de9ed3d98eb6e37b
- SSDEEP 768:it81vCu5ZnWpQgUMq9+12GDuRUP6Ez9Ctwgg/wI2oRPfFSTYJa2U:iqOpQCq9+1VDuSVIhJGe
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion discovery persistence upx
- Modifies WinLogon for persistence
  persistence
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10
- Target
  xpiofrbtkzhr.exe
- Size 46KB
- SHA256 6a298fd7189f63d29fb4c4cc342844a98c10945f8e0700363b0d078111568528
- MD5 25a11c9dd8d3eb6ecf8544e95d866a98
- SHA1 b462e8f5a05dba7328885af7646f9229d09656fb
- SHA512 2483c4b7dad5bf273c955c70716dcb61a7f61ea1047de6f03ab867e549a3791a1c93291ef9d81e6308eecffb3a05f963b45f8b539ab31f84c5520844cb8a8992
- SSDEEP 768:1ySfi5TqmFi4tuXnKtgYr/TOsex9PEMBex6BHmRGBNc1uobW80vOA4N:dK5TbUayYLTOh9PEMEx+O150vOPN
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence upx
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11
- Target
  xxx_video (2).exe
- Size 608KB
- SHA256 d51d08aef8661780261241ddb5bb2617b1fafa1ac1cdcad77e825c16faf48c79
- MD5 2bcae695288cd75a2d71c0dbb69359fd
- SHA1 6a0476b62c069d42a2d8290b7d467d8a136312e7
- SHA512 a28d5299addd39b0905745889cc478549c295ba9a19d49b1b0fe723840c298d0793203627ea5852e91ed2efc6684d2cf7362ff2958e52eb30c859cab497b0e96
- SSDEEP 12288:ao7VLRpB3hC/K+wAN0PdyT9ElIdq5uMumzu5FEiXqv3RZF8N4E:9P5zZI43
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral12
- Target
  xxx_video.exe
- Size 74KB
- SHA256 2a9e5ded530da46678845fc5f3be1f83819b6a255765174eb4ae06ba4abb5b53
- MD5 ed6cec1486bd9af8a567604112f786bf
- SHA1 147b9b965701a42fb6e8088da0abf4eb3b987d1c
- SHA512 e8e1ae480b129a9bff0d98c65d212973be9892f4fa103a78bbb275f3d3be7c68e871888dcb73bcdd35c3958f9d7b889671b9d8aadbdc4623c4b4a81ba182805b
- SSDEEP 1536:Y4adWLt4aPI7ZPItWEK01i+jmcIJID+U5pnouy8NM:C8LGaPI7ZPItFK0zxIC9noutNM
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13
- Target
  xxx_video_26726.avi.exe
- Size 62KB
- SHA256 76520b94f15467309d3ca3d8022bb156e8daa811223774b7a74127881ab50fc0
- MD5 91096e06bc95a718d0b67661764a92b3
- SHA1 a05df3707c71b2cedfb94bb81c6c1af3311be235
- SHA512 67dd71681bbde5dd5c2972f57930b856c68d90b5cf2f0edbbdfcdf2b6fb5898ff2ecfe58be6aa4aa8b0aa88bacee6a58043fa8733b5b911f2c478f30347e715d
- SSDEEP 1536:zX9X3D0CmuUFQArTc+OMnlf5JSVeK69mEgey5O:79n7Urc+dnlB4VzLTw
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery persistence upx
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral14
- Target
  xxx_video_35942.avi.exe.vir.exe
- Size 52KB
- SHA256 0a5506d1867dbb76b428b099b2ae6a3ec0c85ec8dc855b66ae822fcc77ba0f12
- MD5 cc279bf22bc5f3348034cc732db279df
- SHA1 1df6eceb7417fdca34ec2e351752e62b9e308bf0
- SHA512 c76c05b996b13815be43c640773b73e1aaaf34b642502098e0ed736e4dc98ee071a89a4d524a7440a3b2a3fd2d571d0396658070268d1e2e04a5a4e4555c6875
- SSDEEP 1536:VxpWSs6Ugax7sR5T3qgWXHYccHbs3CJP0YLI:V7WSs7Fx7sR5joHYcmYk8c
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery persistence upx
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15
- Target
  xxx_video_35942.avi_unpacked_.exe.vir.exe
- Size 74KB
- SHA256 2c7a6f717702e2789aa4813bbeef2890edfcb216c0af83ac399015853c057c80
- MD5 af5c2e270346cdb9206ab7c09074a13f
- SHA1 b20c204a948da5f41b1cc8c047ca4c410b67f60d
- SHA512 dffa29aa1a627455a1d04e86238dbbc52f881281c66f3d278f176794a32ce3a5920a101fff8ae85322d962021a8fb6a1c1ac96a2a2fd382f407cb3ce6ae58310
- SSDEEP 768:V7B7vOri/ija+1IqhZ9o9nn6vRhwXzqaRMicwVSeRSNRGfbxuuNtpzWLhp4oQsSJ:V7B7vyDo9nadaRuwweBzxJWLv6smf
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
behavioral16
- Target
  xxx_video_73240.avi____.exe.vir.exe
- Size 202KB
- SHA256 4a47be4e443a8d327b607cf606994666dfcd688ae02a50b9c7c0ea2b0e0c9b41
- MD5 ec1515255dd45a0fa15a23fe5f07a23e
- SHA1 e61bf707f6eaa7009504c65f2d498de72818f738
- SHA512 23c8b170549c5d1340938a152bcf4ab0cdcddbe6d446be3bdcbb9c211127d60013fbe00019208151c784e6f522ae5770e546f4dec88cf285a891a3938648b526
- SSDEEP 768:vs8Rt5Kv/2CxxurzvCW6QtKarJ0R9ShWbSt+Y41P+MBefyap3eKFW3e:vf4vgzKWxkaiR9Shp+Y0mMBeqapVFW
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
behavioral17
- Target
  xxx_video_77498.avi.exe
- Size 53KB
- SHA256 8041d6917560303a9562dfe705a8c57c57425f11f61ffe9e91907e19cfe8619e
- MD5 1980cdff48796a156a69bbc5b71b8bc6
- SHA1 feec2e4f363839525ffea205a33d7a1c0241a5f8
- SHA512 01b297498995e0ecc4c2f3bde81a3fd6abe93924cd930712a97f2932e5f18693a545ec7ab76c768a740b3e4e11ffb010fc49455127649438656d015fa6bb17d6
- SSDEEP 768:W9881n/iH9YJVNv0ryM8CZarJ305Q0nUxtLnZ0XX5FcfH7Gt61:czCYJVNvPM3Zap05Qb3ZoFcfbb1
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Disables Task Manager via registry modification
  evasion
behavioral18
- Target
  xxx_video_87279.avi.exe.vir.exe
- Size 47KB
- SHA256 d29dac501b57a07abdc2f7da0550fffa9ed321d228b50235eb76ccb248f0d4e9
- MD5 a5fe0efa78b0b70bfe86b62f55cf8ba6
- SHA1 39a3c0aa0795d2d81cba8e998735b2df77eadea5
- SHA512 b01378c32c893ea5a7c0c892515fd93ef005b867df86ab0896bb15b7b06b71d1e1acad009c330a8e943378f579615370b6c3966d46c83d883773cff9970233a1
- SSDEEP 768:Vtr+TB0qJUvzy7idWzLql4Ha71YpJaskLnkKDakY2S1MDiuk:v+8v2gWnCcaJEUKR2Ov
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery persistence upx
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19
- Target
  zcrypt.exe
- Size 791KB
- SHA256 bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f
- MD5 d1e75b274211a78d9c5d38c8ff2e1778
- SHA1 d14954a7b9e0c778909fe8dcad99ad4120365b2e
- SHA512 1ec3fbb0bf17d4ad6397ba2e58daa210745f10f88f6722971464a6eeb7573f49be6d65e70a497002d6d00745317f11442bdeaf999b91127b123c11dfe9b088c2
- SSDEEP 24576:l2RNuxIAdOx6mNoGSyGMjc6XaMAy9xg5tMZ/Z3RPpEYrTQAU:rIG+lbGuntxktM15RPpEYrTQAU
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral20
- Target
  {71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
- Size 338KB
- SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
- MD5 04fb36199787f2e3e2135611a38321eb
- SHA1 65559245709fe98052eb284577f1fd61c01ad20d
- SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
- SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

cryptolocker discovery persistence ransomware
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Cryptolocker family
  cryptolocker
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral21