Overview

overview

10

Static

static

3

2025-05-22...er.exe

windows10-2004-x64

8

2025-05-22...er.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2025-05-22_89529b46579c9b3f71b05351e8afc49e_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer
  • Size 994KB
  • Sample250522-rr4znavrx9
  • SHA256 258b0d5608db63edb2a1c5a62356a3206d4b3bd7f30c988322deea8782ee01b6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ouroborosdefense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target
      2025-05-22_89529b46579c9b3f71b05351e8afc49e_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer
    • Size 994KB
    • SHA256 258b0d5608db63edb2a1c5a62356a3206d4b3bd7f30c988322deea8782ee01b6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverypersistenceprivilege_escalationouroborosransomware

    • Ouroboros family

      ouroboros

    • Ouroboros/Zeropadypt

      Ransomware family based on open-source CryptoWire.

      ransomwareouroboros

    • Modifies Windows Firewall

      defense_evasion

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks