ouroboros | 6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507 | Triage™

Login
Reports

Overview

overview

Static

static

3

6e19ae14f0...07.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507
Size 1002KB
Sample250521-vyak6seq3t
SHA256 6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507
MD5 637a86d22062c2b5c730c68427e93e23
SHA1 64d41a477f82fb3e74aca668d1bcd21e5091c498
SHA512 ce11d65a6325d051b2b7a1bf416f241f7aec435e51c73631b0bc43b0ad802915e411d8bf568bca596617e62c9cb7f38b2046e9b1ee296e7ebb70863e4b9fb4d6
SSDEEP 24576:mDmr77qzQk4J0FdC52eGlgTsr8DST4sDECfopKn/2wmScgytJ:mDmr77kQk4Nwe4gmbAfInHmSchtJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ouroboros defense_evasion discovery persistence privilege_escalation ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507.exe

Resource

win10v2004-20250502-en

windows10-2004-x64

10 signatures

150 seconds

ouroboros defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Targets

- Target
  6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507
- Size 1002KB
- SHA256 6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507
- MD5 637a86d22062c2b5c730c68427e93e23
- SHA1 64d41a477f82fb3e74aca668d1bcd21e5091c498
- SHA512 ce11d65a6325d051b2b7a1bf416f241f7aec435e51c73631b0bc43b0ad802915e411d8bf568bca596617e62c9cb7f38b2046e9b1ee296e7ebb70863e4b9fb4d6
- SSDEEP 24576:mDmr77qzQk4J0FdC52eGlgTsr8DST4sDECfopKn/2wmScgytJ:mDmr77kQk4Nwe4gmbAfInHmSchtJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ouroboros defense_evasion discovery persistence privilege_escalation ransomware
- Ouroboros family
  ouroboros
- Ouroboros/Zeropadypt
  Ransomware family based on open-source CryptoWire.
  ransomware ouroboros
- Modifies Windows Firewall
  defense_evasion
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ouroborosdefense_evasiondiscoverypersistenceprivilege_escalationransomware

© 2018-2026

Terms | Privacy