Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

cfd5d9a4e6...f0.exe

windows10-ltsc_2021-x64

cfd5d9a4e6...f0.exe

windows7-x64

cfd5d9a4e6...f0.exe

windows10-2004-x64

cfd5d9a4e6...f0.exe

windows10-ltsc_2021-x64

cfd5d9a4e6...f0.exe

windows11-21h2-x64

da6f543313...2e.exe

windows11-21h2-x64

6

da6f543313...2e.exe

windows7-x64

6

da6f543313...2e.exe

windows10-2004-x64

6

da6f543313...2e.exe

windows10-ltsc_2021-x64

6

da6f543313...2e.exe

windows11-21h2-x64

6

e05323d9ca...62.exe

windows11-21h2-x64

3

e05323d9ca...62.exe

windows7-x64

1

e05323d9ca...62.exe

windows10-2004-x64

3

e05323d9ca...62.exe

windows10-ltsc_2021-x64

3

e05323d9ca...62.exe

windows11-21h2-x64

3

e48bd2f16b...14.exe

windows11-21h2-x64

10

e48bd2f16b...14.exe

windows7-x64

10

e48bd2f16b...14.exe

windows10-2004-x64

10

e48bd2f16b...14.exe

windows10-ltsc_2021-x64

10

e48bd2f16b...14.exe

windows11-21h2-x64

10

ecfb5c95d0...9d.exe

windows11-21h2-x64

10

ecfb5c95d0...9d.exe

windows7-x64

10

ecfb5c95d0...9d.exe

windows10-2004-x64

10

ecfb5c95d0...9d.exe

windows10-ltsc_2021-x64

10

ecfb5c95d0...9d.exe

windows11-21h2-x64

10

f08c1c26d3...3f.exe

windows11-21h2-x64

6

f08c1c26d3...3f.exe

windows7-x64

6

f08c1c26d3...3f.exe

windows10-2004-x64

6

f08c1c26d3...3f.exe

windows10-ltsc_2021-x64

6

f08c1c26d3...3f.exe

windows11-21h2-x64

6

Resubmissions

25/03/2025, 13:12

250325-qfl42aznw9 10

25/03/2025, 13:09

250325-qdtq4aznv6 10

25/03/2025, 13:05

250325-qbtcjszns3 10

25/03/2025, 13:01

250325-p9k86awxat 10

25/03/2025, 12:55

250325-p58tnawwe1 10

25/03/2025, 12:51

250325-p3txqazmt6 10

05/02/2025, 11:16

250205-ndjvsavrdm 10

16/07/2024, 08:54

240716-kt64gavakp 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    533.7z

  • Size

    2.7MB

  • Sample

    250325-qdtq4aznv6

  • MD5

    7aded2388d27c5dc782dca435f160857

  • SHA1

    744f53fe1f4c7a43a82e1a942eb71f4175da8935

  • SHA256

    3730e9cba4a93bc985ef7cd2368ccbf5eccd4724f514b38b20e320e5553dd08d

  • SHA512

    518957e9248e65c5231e10c3977d01f7d3b4aa43f08b00c668be8501a88e06d1eaa2a5aaf976ab9caa1d2eacbc7a2029731d5a7054df230aaf93a79294d9083b

  • SSDEEP

    49152:BdRLSYLgm9h2iT/1Xd6STMtS07Cqjgfzj8flramouva2dd1ALRNyndSBSJQIQV:BdNtJPDJXd62MY50R+a5X1my8BSJQzV

Score
10/10
blackmatterchaosgandcrablockbitmakopmimicmodiloadernefilim512478c08dada2af19e49808fbda5b0bdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Family

blackmatter

Version

1.2

Botnet

512478c08dada2af19e49808fbda5b0b

Credentials
C2

https://paymenthacks.com

http://paymenthacks.com

https://mojobiden.com

http://mojobiden.com
Attributes
  • attempt_auth

    true

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Extracted

Path

C:\Users\Admin\Documents\andrianov.txt

Ransom Note
Your Personal Files has been Encrypted and Locked Your documents, photos, databases and other important files have been encrypted with strongest encryption and locked with unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. Caution: Removing of Blackhat will not restore access to your encrypted files. Frequently Asked Questions What happened to my files ? understanding the issue How can i get my files back ? the only way to restore your files What should i do next ? Buy decryption key Now you have the last chance to decrypt your files. 1. Buy Bitcoin (https://blockchain.info) 2. Send amount of 200 dollar to address: to 3QpLGGaeFwxtV61p1bBUpTBzPcKdtPQpNA 3. Transaction will take about 15-30 minutes to confirm. 4. When transaction is confirmed, send email to us at [email protected] Click here to restore and recovery your files
Wallets

3QpLGGaeFwxtV61p1bBUpTBzPcKdtPQpNA

Extracted

Path

C:\Program Files\README_5442903.txt

Ransom Note
Hello! All your files have been encrypted... Your personal Id: ADkTOOmai/3VrhwOMe6gxxyPK0vpJeW31RAieyF9rmHoWyqU7qoqvm80gmlQL8UQl0GFvHxwpzN2rwbkriAleQ0k/vYFS+gTRmu3iRHd8Ql6W2CrzqH1uhbyLSFGKxi2CqGzf2AWTNPa8YlKQZmK5Mt4ebOXIgURgIXHZIT+1i5ugMd87SXyn4ZIDxscj7ocKUbrYMP6O81cK1P2Mq7qrmirdAktxXu1nyJapOUFvS/cmE3yLj0AFu7LU/rXwBS2JXYQQGnatOWaG7ErwFJVG77HUe9H8a75ewyZwnvE6wIfF7UzWjjlwijQD+YG5cIjzvKrYr8lcnO/EL49Ag8dhg++ZW4tVVNfNTQ0MjkwM19BZG1pbl8zLzI1LzIwMjUgMTowOTozNSBQTV9XaW4gMTBfYmx1dDRfZWNmYjVjOTVkMGYzZDExMjY1MGVmNDA0NzkzNmU4ZmE1MjQ0YzIxYzkyMWY2YzdhNjk2M2U5MmFiYWI0OTQ5ZA To decrypt your files, write to email: [email protected] or [email protected] In the letter, send your personal Id and 2 small encrypted files for trial decryption. If you dont get answer from [email protected] or [email protected] in 72 hours, you need to install tor browser, you can download it here: https://www.torproject.org/download/download.html.en After installation, open the tor browser to website: http://t5vj34iny72dpdu4.onion and follow the instructions. Do not try restore files without our help, this is useless, and can destroy you data permanetly. However, the files can be recovered even after the removal of our program and even after reinstalling the operating system. Download the decoding video here: https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi
URLs

http://t5vj34iny72dpdu4.onion

https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\README_6296936.txt

Ransom Note
Hello! All your files have been encrypted... Your personal Id: OrrRonhSOZtRXbzBj3UjWRCgnymueZGTpEJUSHy+BxsFBralnrhPgwndxXW9LI/xMTY/TYLZOdsAMXG/utMmtEBbqJn2woiOltoNwyN9mXU/IdYSp3J+NH4aZqfIcVYl0BKbpWi25AVuzmmq+8L+lAbwhoo5QPdBRWnm5zDQCkXz0fBshfpkkz3VJ1NSyP+S3ZqvpFUinkcs6Dm4cHy81mBqLIQo3ALrn0bdb+uGXddyHER1sqFqFV4C5srol4vRgBM4PoZh3vafgZAaadPDD7itrQYltlpzTHLYt+7Qb+cLkqusYo7WUEw6bsWuTpQT1a3BwGx9U1YbStiIwp1vqw++ZW4tVVNfNjI5NjkzNl9BZG1pbl8zLzI1LzIwMjUgMTowOTozNSBQTV9XaW4gN19ibHV0NF9lY2ZiNWM5NWQwZjNkMTEyNjUwZWY0MDQ3OTM2ZThmYTUyNDRjMjFjOTIxZjZjN2E2OTYzZTkyYWJhYjQ5NDlk To decrypt your files, write to email: [email protected] or [email protected] In the letter, send your personal Id and 2 small encrypted files for trial decryption. If you dont get answer from [email protected] or [email protected] in 72 hours, you need to install tor browser, you can download it here: https://www.torproject.org/download/download.html.en After installation, open the tor browser to website: http://t5vj34iny72dpdu4.onion and follow the instructions. Do not try restore files without our help, this is useless, and can destroy you data permanetly. However, the files can be recovered even after the removal of our program and even after reinstalling the operating system. Download the decoding video here: https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi
URLs

http://t5vj34iny72dpdu4.onion

https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi

Extracted

Path

C:\Program Files\README_9993492.txt

Ransom Note
Hello! All your files have been encrypted... Your personal Id: g2nD8IuIdvLhH8DfyA4imst6Dk+cJvsuoquJWnoEoyoxN8LQBlXtXihrWPxTKuLJXt28cTwtoI+x0h/23sJ/Pz5PJ15OjZ5POp73NoQ2lZGkbw+IqF0EhdiRSpB442hMBwEI1TzxwmOCvbnvyzgc+VPzMESvteoFfvfL7AquKiEoo+dXfy5QAxd16NUFy0mg4A76wPr2eus/M07tY3TkW2KrFjRVtIihBd9bCEeiAMCLurlj3HuX6PGdbN/0Kt/YasHmumtLFwVS4lHrGjrXqWINQajHa5c76wEhX0GXlcYlX9NWMcFLt4hYzH1tw13Y9+gKPPflp8eIrKQAii7eBw++ZW4tVVNfOTk5MzQ5Ml9BZG1pbl8zLzI1LzIwMjUgMTowOTozNSBQTV9XaW4gMTBfYmx1dDRfZWNmYjVjOTVkMGYzZDExMjY1MGVmNDA0NzkzNmU4ZmE1MjQ0YzIxYzkyMWY2YzdhNjk2M2U5MmFiYWI0OTQ5ZA To decrypt your files, write to email: [email protected] or [email protected] In the letter, send your personal Id and 2 small encrypted files for trial decryption. If you dont get answer from [email protected] or [email protected] in 72 hours, you need to install tor browser, you can download it here: https://www.torproject.org/download/download.html.en After installation, open the tor browser to website: http://t5vj34iny72dpdu4.onion and follow the instructions. Do not try restore files without our help, this is useless, and can destroy you data permanetly. However, the files can be recovered even after the removal of our program and even after reinstalling the operating system. Download the decoding video here: https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi
URLs

http://t5vj34iny72dpdu4.onion

https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi

Extracted

Path

C:\Program Files\README_2081251.txt

Ransom Note
Hello! All your files have been encrypted... Your personal Id: JSO+F4GXS7XFVUNpMVbqnRpC9D+g1jgJDdq3GYOQjIWG4qJCQ0Fez6S1quW0t1/ZHlCYExTsnWAainxp0omf2bKmaVq6Ms/P7zCxT706+VoG27nu8bgbJn4Pob3Y/lbdvMemQQY5/NYI46fYbqUHytxw7uNP5fzt9573C8EXVJK1gXU+xY0o2yFNe+SjYhqply4QLpoMIWM/he74Smr0xFHr3lzMW+fLviEc+nOGgf7cwOh4/aa0TubyrpSpbHFNC9TRZ5nPATnZwXka3QtAOrvH+X2+ix71dYqXTJKk0o9uqG00t+LAit8mCMZYiIwxh+MyFJf1SZszDPPjwK1vIg++ZW4tVVNfMjA4MTI1MV9BZG1pbl8zLzI1LzIwMjUgMTowOTozOSBQTV9XaW4gMTBfYmx1dDRfZWNmYjVjOTVkMGYzZDExMjY1MGVmNDA0NzkzNmU4ZmE1MjQ0YzIxYzkyMWY2YzdhNjk2M2U5MmFiYWI0OTQ5ZA To decrypt your files, write to email: [email protected] or [email protected] In the letter, send your personal Id and 2 small encrypted files for trial decryption. If you dont get answer from [email protected] or [email protected] in 72 hours, you need to install tor browser, you can download it here: https://www.torproject.org/download/download.html.en After installation, open the tor browser to website: http://t5vj34iny72dpdu4.onion and follow the instructions. Do not try restore files without our help, this is useless, and can destroy you data permanetly. However, the files can be recovered even after the removal of our program and even after reinstalling the operating system. Download the decoding video here: https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi
URLs

http://t5vj34iny72dpdu4.onion

https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi

Extracted

Path

C:\Program Files\README_3499930.txt

Ransom Note
Hello! All your files have been encrypted... Your personal Id: IkxOr1eysYafde1iaxbpZmniXyfoRKjjlMV1+tItfDG7N4xrBsI7Nvq4wirkA38BCEBVlJ2SScuK3+a0SPYONnD/DM4zhcpkIGyApnF3TOE5coc5DvwWHkmsHKEuNxemmp+0e7ZbWNtVm2LPvkG+g/Q/5dAu1w99NSBAS6DAVeIy0X0C+8UOS3LdKJCCeLsds8zywWj3rrrr9x57E31mM/7X6SVSTKEl1/PlySlEEwP0JjHSiAcP6QW0oXQCNPZovgCAU8i9ZZoicLEH1jLQh1MS9qCKqWp6NI7MI+GbekeUpeTZZMiHNrvGI1Rsd/a9EsHyJhB1yaubtlq3pnkzGw++ZW4tVVNfMzQ5OTkzMF9BZG1pbl8zLzI1LzIwMjUgMTowOTo0MCBQTV9XaW4gMTBfYmx1dDRfZWNmYjVjOTVkMGYzZDExMjY1MGVmNDA0NzkzNmU4ZmE1MjQ0YzIxYzkyMWY2YzdhNjk2M2U5MmFiYWI0OTQ5ZA To decrypt your files, write to email: [email protected] or [email protected] In the letter, send your personal Id and 2 small encrypted files for trial decryption. If you dont get answer from [email protected] or [email protected] in 72 hours, you need to install tor browser, you can download it here: https://www.torproject.org/download/download.html.en After installation, open the tor browser to website: http://t5vj34iny72dpdu4.onion and follow the instructions. Do not try restore files without our help, this is useless, and can destroy you data permanetly. However, the files can be recovered even after the removal of our program and even after reinstalling the operating system. Download the decoding video here: https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi
URLs

http://t5vj34iny72dpdu4.onion

https://content.screencast.com/users/tywlgpwg/folders/Default/media/3c1aeb4c-5386-41df-8eee-346487877522/decryption.avi

Targets

    • Target

      cfd5d9a4e67799f2428c6071dcc13fcf726f49ec3e706f0302b4592a3a0a08f0.exe

    • Size

      68KB

    • MD5

      5de719d56f38039bb9c915d689a5a4da

    • SHA1

      f46d4ed9851b0980d5a9139defd456a58c6aaaaa

    • SHA256

      cfd5d9a4e67799f2428c6071dcc13fcf726f49ec3e706f0302b4592a3a0a08f0

    • SHA512

      48756ac79f23cb26620ff135fe93a87768cf9a02b941ade68e3e27981adc8431f76d58aa057525de88742c7ec900b4ea02c52abb3889cd176a3ae14e956dc678

    • SSDEEP

      768:oY53/zkfCQxmGgV5YlpJ6RIDWeRdppvO/9rjca9nsUKhK:B/z5Qxd6m3WIw9MhK

    Score
    1/10
    behavioral1behavioral2behavioral3behavioral4behavioral5

    • Target

      da6f543313480695aab95a5e685741a8d185fba0600363f74063eb1cda0f672e.exe

    • Size

      117KB

    • MD5

      bca754bd6e7b4c7b23e17d0244e425d0

    • SHA1

      257cef8651509e1e33d95b07d5a7b07fcf1f6f4f

    • SHA256

      da6f543313480695aab95a5e685741a8d185fba0600363f74063eb1cda0f672e

    • SHA512

      02cab68478ad9b3c14336d2178a642d27b7ca3af6beb9ecfbddd8f6c5641164d0728df9821e5c59385831cb63178e7837670f779b81a66e079ada5cb66eac7d4

    • SSDEEP

      3072:xd5BJOoMqqDL2/OvvdHv3uqz3++OAYWgO:xdJODqqDL6gvdHveqi+GWgO

    Score
    6/10
    discoverypersistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral6behavioral7behavioral8behavioral9

    • Target

      e05323d9ca6df47d9add5b2f757ea2490ebd11dfe1b56b82a9e93ba9d814e162.exe

    • Size

      195KB

    • MD5

      ed9150c61fd66757f5dc1357c1384617

    • SHA1

      220466f711e96f202c107d4ed05ffe837c1099a3

    • SHA256

      e05323d9ca6df47d9add5b2f757ea2490ebd11dfe1b56b82a9e93ba9d814e162

    • SHA512

      4690335470be0512010db4b4ffde42043602fdff9587ecc930fbbcec694bf934e7c140ccdec4e8c7aa3d1aff97940ee4c75ba27a71ee29a3c3fc5cf873154fd4

    • SSDEEP

      3072:Jquj3THroBGHnTKslI0rjxHTgLcbE/6i6e1eXC/T9CJg29LV4q9/:B3THkBGHTKLMtHTd4/UbXUT9X2rP9

    Score
    3/10
    discovery
    behavioral11behavioral12behavioral13behavioral14behavioral15

    • Target

      e48bd2f16b53a3630f3fca69d0d236d15bc23b08754d980bd29b15841b0fdf14.exe

    • Size

      137KB

    • MD5

      9b02b542834573f9502ca83719a73a01

    • SHA1

      f3bc7cf16eec977772455f3fce87fed505fb18e3

    • SHA256

      e48bd2f16b53a3630f3fca69d0d236d15bc23b08754d980bd29b15841b0fdf14

    • SHA512

      290c7a5bfc921817d1803ddbe8dd07210301082498945bcabdb597368f92c6fc1050cefec514e6d250571cb4afd6427d8e4ab7cd15d7a46a44cb088cd4d1b031

    • SSDEEP

      3072:Eoy7AHYqr9ACDYVbu4sijUtSWnFA22WnVaxs2gzx+IjBz2:0mr9AHVycjUgWnFAGms2gzoch

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (199) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral16behavioral17behavioral18behavioral19behavioral20

    • Target

      ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe

    • Size

      52KB

    • MD5

      ba9210de03de945901f02792f7994871

    • SHA1

      20c4569cbb6f2650b02f6a5257faa8a8dfb298bd

    • SHA256

      ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d

    • SHA512

      277d26eea627b3da26664aaa4f72a7b79cd50311e45c59333563b4f58b76e6562cbaa1d55127c69d0830864721efa890fa824e1be381cca5e84bddc98f2b44d0

    • SSDEEP

      1536:EJJRZQJes5b0k5bbyu6hXOKJrkH6sNNW:oJRa4kLmNVOKJIasNE

    Score
    10/10
    defense_evasiondiscoveryevasionexecutionimpactpersistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral21behavioral22behavioral23behavioral24behavioral25

    • Target

      f08c1c26d375f6881990756e39208017b02af75fca0ebddb72f5e5c14e20363f.exe

    • Size

      70KB

    • MD5

      4784fae86332064057d0ab8b73a1b67e

    • SHA1

      f38b61a64119b8b1c2562ca8a6416a2b0c7528b8

    • SHA256

      f08c1c26d375f6881990756e39208017b02af75fca0ebddb72f5e5c14e20363f

    • SHA512

      62312d637d0feda0f565841274ecff5f07cfada08d7a899d68deb314f52d9d5e64733ba6a8fae7b979625b0302e9f270419cf1801239cf597c5af19b47aaf686

    • SSDEEP

      1536:1ZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:kd5BJHMqqDL2/Ovvdr

    Score
    6/10
    discoverypersistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral26behavioral27behavioral28behavioral29behavioral30

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

Remote System Discovery

1
T1018

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

4
T1490

Tasks

static1

upx512478c08dada2af19e49808fbda5b0bmakopchaosnefilimmimicblackmattermodiloadergandcrablockbit
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

discoverypersistence
Score
6/10

behavioral7

discoverypersistence
Score
6/10

behavioral8

discoverypersistence
Score
6/10

behavioral9

discoverypersistence
Score
6/10

behavioral10

discoverypersistence
Score
6/10

behavioral11

discovery
Score
3/10

behavioral12

Score
1/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer
Score
10/10

behavioral17

chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer
Score
10/10

behavioral18

chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer
Score
10/10

behavioral19

chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer
Score
10/10

behavioral20

chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer
Score
10/10

behavioral21

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral22

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral23

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral24

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral25

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral26

discoverypersistence
Score
6/10

behavioral27

discoverypersistence
Score
6/10

behavioral28

discoverypersistence
Score
6/10

behavioral29

discoverypersistence
Score
6/10

behavioral30

discoverypersistence
Score
6/10