General
- Target 2025-11-17_2b657ce27d9f5c9ffb5990c9705f8ade_elex_wastedlocker
- Size 58KB
- Sample251117-fr3aaadm71
- SHA256 770201070ed3e19271b310c8bbd44617ff24e51fdb771c30f9adba3f0d7b36b3
- MD5 2b657ce27d9f5c9ffb5990c9705f8ade
- SHA1 b56f2df1472720cd451ad5dc3d97c4a455a3818d
- SHA512 9b25ce8891cc498d3644d40d77c01a5bfac913150eb4656e883bf0af31d5c3294ee91c3bd7d9f72e26b28cd7db0e40098e496a7f28f7329c150fd9a9a88f6d8a
- SSDEEP 1536:HO88wNYmqdeBk7G7IhhqZKWVKz8NqUxVl2HihgOrT8avvvvvvvvvvvvvvvvvvvv:HOmhqdeBk+nc9OrTZvvvvvvvvvvvvvvX
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-11-17_2b657ce27d9f5c9ffb5990c9705f8ade_elex_wastedlocker.exe
Resource
win10v2004-20251016-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-11-17_2b657ce27d9f5c9ffb5990c9705f8ade_elex_wastedlocker.exe
Resource
win11-20251015-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2025-11-17_2b657ce27d9f5c9ffb5990c9705f8ade_elex_wastedlocker
- Size 58KB
- SHA256 770201070ed3e19271b310c8bbd44617ff24e51fdb771c30f9adba3f0d7b36b3
- MD5 2b657ce27d9f5c9ffb5990c9705f8ade
- SHA1 b56f2df1472720cd451ad5dc3d97c4a455a3818d
- SHA512 9b25ce8891cc498d3644d40d77c01a5bfac913150eb4656e883bf0af31d5c3294ee91c3bd7d9f72e26b28cd7db0e40098e496a7f28f7329c150fd9a9a88f6d8a
- SSDEEP 1536:HO88wNYmqdeBk7G7IhhqZKWVKz8NqUxVl2HihgOrT8avvvvvvvvvvvvvvvvvvvv:HOmhqdeBk+nc9OrTZvvvvvvvvvvvvvvX
- MD5 SHA1 SHA512 SSDEEP
-
Wastedlocker family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (125) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Possible privilege escalation attempt
-
Executes dropped EXE
-
Modifies file permissions
-
Drops file in System32 directory