General
- Target 2025-11-14_e5e899ba4a84df92dd7856b41fa956d3_elex_wastedlocker
- Size 56KB
- Sample251114-ynqq7askbp
- SHA256 9fd59efa518e4ab927b62fbd007abe43501c1ef8a6d8d143a0d667f34cd4f953
- MD5 e5e899ba4a84df92dd7856b41fa956d3
- SHA1 9d410ae1727d588d57db0417076d28e1b234ce66
- SHA512 75c301ea933e6f6853e8c7a915d43da2296644f52282928e22c0a3c017b19f88d5425ae1e35fe36879395356b7abde6f68d6cf9e5e74522950cf04195be04185
- SSDEEP 1536:PO88wNYmqdeBk7G7IhhqZKWVKz8NqUxVcSgJE/n:POmhqdeBk+nu
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-11-14_e5e899ba4a84df92dd7856b41fa956d3_elex_wastedlocker.exe
Resource
win10v2004-20251016-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-11-14_e5e899ba4a84df92dd7856b41fa956d3_elex_wastedlocker.exe
Resource
win11-20250619-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2025-11-14_e5e899ba4a84df92dd7856b41fa956d3_elex_wastedlocker
- Size 56KB
- SHA256 9fd59efa518e4ab927b62fbd007abe43501c1ef8a6d8d143a0d667f34cd4f953
- MD5 e5e899ba4a84df92dd7856b41fa956d3
- SHA1 9d410ae1727d588d57db0417076d28e1b234ce66
- SHA512 75c301ea933e6f6853e8c7a915d43da2296644f52282928e22c0a3c017b19f88d5425ae1e35fe36879395356b7abde6f68d6cf9e5e74522950cf04195be04185
- SSDEEP 1536:PO88wNYmqdeBk7G7IhhqZKWVKz8NqUxVcSgJE/n:POmhqdeBk+nu
- MD5 SHA1 SHA512 SSDEEP
-
Wastedlocker family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (128) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Possible privilege escalation attempt
-
Executes dropped EXE
-
Modifies file permissions
-
Drops file in System32 directory