General

  • Target

    2025-05-15_042a1bb775a1bf1e158ddd77a2c0ab25_elex_virlock

  • Size

    783KB

  • Sample

    250515-dx9kfazyfw

  • MD5

    042a1bb775a1bf1e158ddd77a2c0ab25

  • SHA1

    11829aa59f7ea7b7ed4bddd9900a0ebf7a8e7464

  • SHA256

    efc2e7e8df920c7b2242fb9266e55b987d2150c1dda8a13687eb533a70b993a3

  • SHA512

    4c650d9d7354b4b7e5ccdad295fa474b06e7a5c63ee8db6b5a1928435641a040364fceaaca632e4e1973869b9f544f280f496c9742abf15aa53c4554c0646747

  • SSDEEP

    6144:5iNUYoJoUIG06YJWoj7Sgx+gCdPUhOeZx0UkW4UyJx:5JoUIGiJWoj7Sgx+gCdPUhOeZx0UU

Malware Config

Targets

    • Target

      2025-05-15_042a1bb775a1bf1e158ddd77a2c0ab25_elex_virlock

    • Size

      783KB

    • MD5

      042a1bb775a1bf1e158ddd77a2c0ab25

    • SHA1

      11829aa59f7ea7b7ed4bddd9900a0ebf7a8e7464

    • SHA256

      efc2e7e8df920c7b2242fb9266e55b987d2150c1dda8a13687eb533a70b993a3

    • SHA512

      4c650d9d7354b4b7e5ccdad295fa474b06e7a5c63ee8db6b5a1928435641a040364fceaaca632e4e1973869b9f544f280f496c9742abf15aa53c4554c0646747

    • SSDEEP

      6144:5iNUYoJoUIG06YJWoj7Sgx+gCdPUhOeZx0UkW4UyJx:5JoUIGiJWoj7Sgx+gCdPUhOeZx0UU

    • Modifies visibility of file extensions in Explorer

    • Renames multiple (87) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks