Extracted

• • Target

    2025-04-06_56c9b50e8936c2516fb1e809d9989912_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch

  • Size

    4.2MB

  • MD5

    56c9b50e8936c2516fb1e809d9989912

  • SHA1

    0fcfa3e92f55200e884c718652ffee7f4ed013e8

  • SHA256

    f14034d2f0c5b5485ef0d868db57bc24b83793681fe7d28e5e89e6b1c3bb0abb

  • SHA512

    5ce6e2288497561d9bd01ce851588d94b25a0b6441973e7c3ab0cb73fae86567702ae091aaca8c32774aae10b23f66ce3730f26c8cb0a662e57f0759900bf31e

  • SSDEEP

    49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4A:ieF+iIAEl1JPz212IhzL+Bzz3dw/VC

  Score

  10^/10

  badrabbitdharmagofingwannacrycredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealertrojanworm

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Badrabbit family

    badrabbit

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing

  • Gofing family

    gofing

  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    defense_evasiontrojan

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (133) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops Chrome extension

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1