General
- Target bcd9fa9f553a16595cdc8138cbc57a05_JaffaCakes118
- Size 781KB
- Sample241203-ly1ypazpdw
- SHA256 bd73f27673d98e8d9fb20bec3ef0dd4456e33eefead3839a68c2228a5c1686ab
Score
10/10
Malware Config
Targets
-
- Target Fattura 00384788-00849838.pdf.exe
- Size 884KB
- SHA256 97be6754d010714743932afa3f4ea308e2f0b19212e8b8b150af7cdd3383f44b
Score10/10CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
Ctblocker family
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Drops desktop.ini file(s)
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Drops file in System32 directory
Sets desktop wallpaper using registry
Suspicious use of SetThreadContext
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 e560384c5298ee2123e8340e716b2c4680f51b4d0347995ba3290dbd1130c6c0
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
Score3/10 -
- Target Nwiz.dll
- Size 54KB
- SHA256 60737caef33db58b24924eecaeb13e9d6c6cbc27408fd2c59cda67d326b1495e
Score3/10