General

  • Target

    2025-06-30_08516824272de219fec997f073e48eb6_elex_virlock

  • Size

    1.6MB

  • Sample

    250630-tweaxaak4t

  • MD5

    08516824272de219fec997f073e48eb6

  • SHA1

    2193d8ffb0b36f83f28bd5e5f2c69d132c5d6f69

  • SHA256

    e0dc3e64589e54ffbe002f186e533e11b03ae1244fbfed34a83a02f4943cae07

  • SHA512

    df1034ab396769eff4e070633b14097f8334db0477166d1bde9f91e249f8fec5cd3c0b700bc9be07b74dcd9cc036266d125b5c56ce1601bb3512fc7d4c3d7fbc

  • SSDEEP

    12288:KlxcqvSUosudyZVx/j47xnRnlr27OWFoMAB6M+TxD3UnIB3FxHlGsgWVBWWU+aIr:KlxJFosude747xlWqy7UIVFxFG+jWHhG

Malware Config

Targets

    • Target

      2025-06-30_08516824272de219fec997f073e48eb6_elex_virlock

    • Size

      1.6MB

    • MD5

      08516824272de219fec997f073e48eb6

    • SHA1

      2193d8ffb0b36f83f28bd5e5f2c69d132c5d6f69

    • SHA256

      e0dc3e64589e54ffbe002f186e533e11b03ae1244fbfed34a83a02f4943cae07

    • SHA512

      df1034ab396769eff4e070633b14097f8334db0477166d1bde9f91e249f8fec5cd3c0b700bc9be07b74dcd9cc036266d125b5c56ce1601bb3512fc7d4c3d7fbc

    • SSDEEP

      12288:KlxcqvSUosudyZVx/j47xnRnlr27OWFoMAB6M+TxD3UnIB3FxHlGsgWVBWWU+aIr:KlxJFosude747xlWqy7UIVFxFG+jWHhG

    • Modifies visibility of file extensions in Explorer

    • Renames multiple (75) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks