ouroboros | 795087cf791f117bb6f5eeb2c5b875adf83d3f9e10076ba6731e8dc421823573 | Triage™

Login
Reports

Overview

overview

Static

static

3

sample.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
795087cf791f117bb6f5eeb2c5b875adf83d3f9e10076ba6731e8dc421823573
Size 997KB
Sample250521-vyz6tseq4v
SHA256 795087cf791f117bb6f5eeb2c5b875adf83d3f9e10076ba6731e8dc421823573
MD5 44412c0215d28bac49a8d50bf206302c
SHA1 3fa589b1a4f3510a552a7c8a753ab4acad2458b5
SHA512 9b2fcea84d058488d8ef2b37a7f27d4a65a34787e0105ecd1764d25e7584e325acd7183ebf132739ac594a361ef8998e3417aef16992d9e56a80da503fab1897
SSDEEP 24576:ZjbUgQhQHM5yQwB8SNvkseS1sVsllawKP9Luqy:ZjfHWy6AkKeyllawYiqy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ouroboros defense_evasion discovery persistence privilege_escalation ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

sample.exe

Resource

win10v2004-20250502-en

windows10-2004-x64

9 signatures

150 seconds

ouroboros defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Targets

- Target
  sample
- Size 997KB
- SHA256 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa
- MD5 ba454585b9f42c7254c931c192556e08
- SHA1 0b530303634283a43d53abd9190106869f57ba5a
- SHA512 2cb918eab6776c7cfea031cbb48cc4e33e068489a37f39ba1e246f32fef7a35c3511293b399c81b5b8056bca50d725554866584460f04efe0d65c1d1c625bc4b
- SSDEEP 24576:cjbCs6rQ5y5yQwB8kNdkICSpOBellaIK79luO:cjr5cy8ykCQgllaIm4O
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ouroboros defense_evasion discovery persistence privilege_escalation ransomware
- Ouroboros family
  ouroboros
- Ouroboros/Zeropadypt
  Ransomware family based on open-source CryptoWire.
  ransomware ouroboros
- Modifies Windows Firewall
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ouroborosdefense_evasiondiscoverypersistenceprivilege_escalationransomware

© 2018-2026

Terms | Privacy