Overview

overview

10

Static

static

1

Trojan.Ran...0M.zip

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trojan.Ransom.N3OR4NS0M.zip

  • Size

    55KB

  • Sample

    250218-bz272avqew

  • MD5

    9a17e2a345dec5c2059ba68e8e2f3f7e

  • SHA1

    885f1ec279ec3c9d368d7fc725784be16940896e

  • SHA256

    11e9ca6ae7a3b1c85bfe6bae292cb60bdff4c67c0245bbf0a54cd90832ce3a05

  • SHA512

    982c5a1437630fe6a09aa05cec89b87dca5f721677cafb280e8be0e4eb473e1fffc7e1d933605e22d4ce37fca42a65ca26cc55d1004ee8e5f2819d2124519b31

  • SSDEEP

    1536:+6UyC7Q1Q8gsbFXq//7vBTH0AE1vQzXUCH:+yC7McPbBjW+tH

Score
10/10
chaoshawkeyedefense_evasionexecutionimpactkeyloggerransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      Trojan.Ransom.N3OR4NS0M.zip

    • Size

      55KB

    • MD5

      9a17e2a345dec5c2059ba68e8e2f3f7e

    • SHA1

      885f1ec279ec3c9d368d7fc725784be16940896e

    • SHA256

      11e9ca6ae7a3b1c85bfe6bae292cb60bdff4c67c0245bbf0a54cd90832ce3a05

    • SHA512

      982c5a1437630fe6a09aa05cec89b87dca5f721677cafb280e8be0e4eb473e1fffc7e1d933605e22d4ce37fca42a65ca26cc55d1004ee8e5f2819d2124519b31

    • SSDEEP

      1536:+6UyC7Q1Q8gsbFXq//7vBTH0AE1vQzXUCH:+yC7McPbBjW+tH

    Score
    10/10
    chaoshawkeyedefense_evasionexecutionimpactkeyloggerransomwarespywarestealertrojan

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Hawkeye family

      hawkeye

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (238) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks