Extracted

• • Target

    CircusSpoofer.py

  • Size

    157KB

  • MD5

    3b4e4c0c5fc4553bfe8e0812cf0d6315

  • SHA1

    26bf91e03966cfe0ab142dcb865a41220cae269a

  • SHA256

    218bb2350579eb698341183f06cd53b0dbe42b6654a98f4d84ee423875d582a4

  • SHA512

    5d29169f221f53c53a9d809361bce8ee1b13da52be1c3480e3ee153d8f20fd32b7ba80799ba09264693302be3b28ca1dd53b547e5b23be6b6bd765ff1168a93c

  • SSDEEP

    1536:v9BcQj04+KYojiDqHQotp4FCC1ollo85GzCOrZr26TLdoac/lnlxIZ0:vPX04+SjiWazCCZr2YAJnIZ0

  Score

  10^/10

  badrabbitwannacrybootkitdefense_evasiondiscoveryexecutionimpactmacromacro_on_actionpersistenceransomwarespywarestealerworm

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Badrabbit family

    badrabbit

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1