Overview

overview

10

Static

static

3

BitcoinBla...er.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BitcoinBlackmailer.7z

  • Size

    631KB

  • Sample

    250323-sqkeasvvbz

  • MD5

    8ca6f96a47eb69a320da1464f239c64e

  • SHA1

    27624835fb0b7e97455d24ae8492ce1d2d502e06

  • SHA256

    3a84fef2985ed83eca31af3ab1956c7dd699196bda6d312925fabe10ff073c8f

  • SHA512

    55d671811e6d7bffced62b38b2fed0e417aed8956b1f55e2cacb7453b2089625b2af402cedc6e7be713bf5313e7365b2c0fe9f4f1900c87dea773ee92e7174cc

  • SSDEEP

    12288:/HR93/at68Rq8Cfxq1uZHWTQmVaUkzDzT403y6prL1mR1pIM+NEjV:vb/kM8IxQ+WTSz74My69LcRXIM+NEjV

Score
10/10
jigsawpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      BitcoinBlackmailer.exe

    • Size

      684KB

    • MD5

      52cdf9dc4986a5df3e8b0df4c4d77da6

    • SHA1

      81309c26783f809f9c98edae4a0730aab1bf5ad6

    • SHA256

      7934625ee2b46883d287d31cb3d1d0b2eb3a0ac2a59a22d434b16513af3d1b11

    • SHA512

      44df0ce2bed5238a1c51419b70f8d45c0ebc7ad7938012e9ff71512f51ae9df501dd67863716b8a8362df1079c472ef86a50cd8bbab648d4613bd663f6ce53b3

    • SSDEEP

      12288:Ixd0h1smbbWC+G/d8ke2Ov71Qoh1PCtCSqBHPuDxcSMa+58tbRC:IxRmbyC+Od8cOvWsZVW

    Score
    10/10
    jigsawpersistenceransomwarespywarestealer

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

      ransomwarejigsaw

    • Jigsaw family

      jigsaw

    • Renames multiple (1533) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks