ouroboros | 7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319 | Triage™

Login
Reports

Overview

overview

Static

static

3

7550228f68...19.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319
Size 997KB
Sample250521-vytn2seq3z
SHA256 7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319
MD5 5425c30ebba4f84d1874a2c783932646
SHA1 80db4a06b57e61695389c354f155c26bb125bd71
SHA512 457b1539296379bd93adfbc8c3a172405f9c341d9d8aa1c6a8c1dbb0ff52ae564911b1a1218ec5613a5e9e2bcca0c00001d118fb36868391ee93f8155b304f1f
SSDEEP 24576:SjWlQ6Wmay5yAT4Mu9jR48yIPB/Vix15AlEW:Sj6acyU+Rki5Vix1yGW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ouroboros defense_evasion discovery persistence privilege_escalation ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

Resource

win10v2004-20250502-en

windows10-2004-x64

9 signatures

150 seconds

ouroboros defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Targets

- Target
  7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319
- Size 997KB
- SHA256 7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319
- MD5 5425c30ebba4f84d1874a2c783932646
- SHA1 80db4a06b57e61695389c354f155c26bb125bd71
- SHA512 457b1539296379bd93adfbc8c3a172405f9c341d9d8aa1c6a8c1dbb0ff52ae564911b1a1218ec5613a5e9e2bcca0c00001d118fb36868391ee93f8155b304f1f
- SSDEEP 24576:SjWlQ6Wmay5yAT4Mu9jR48yIPB/Vix15AlEW:Sj6acyU+Rki5Vix1yGW
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ouroboros defense_evasion discovery persistence privilege_escalation ransomware
- Ouroboros family
  ouroboros
- Ouroboros/Zeropadypt
  Ransomware family based on open-source CryptoWire.
  ransomware ouroboros
- Modifies Windows Firewall
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ouroborosdefense_evasiondiscoverypersistenceprivilege_escalationransomware

© 2018-2026

Terms | Privacy