cryptolocker | hxxps://github[.]com/ytisf/theZoo | Triage

Sharing

General

Target

https://github.com/ytisf/theZoo
Sample

250326-bsgbzsypt7

Score

10^/10

cryptolocker android defense_evasion discovery macos persistence ransomware

Malware Config

Targets

- Target
  
  https://github.com/ytisf/theZoo
Score

10^/10

cryptolocker discovery persistence ransomware defense_evasion
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Cryptolocker family
  cryptolocker
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Resource Forking

Modify Registry

Credential Access

Discovery

Browser Information Discovery

File and Directory Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

urlscan1

behavioral1

cryptolockerdiscoverypersistenceransomware

behavioral2

behavioral3

defense_evasiondiscovery