Overview

overview

10

Static

static

10

Malware-1-...30.exe

windows10-2004-x64

10

Malware-1-...30.exe

windows11-21h2-x64

Malware-1-...40.exe

windows10-2004-x64

10

Malware-1-...40.exe

windows11-21h2-x64

10

Malware-1-...32.exe

windows10-2004-x64

10

Malware-1-...32.exe

windows11-21h2-x64

5

Malware-1-.../5.exe

windows10-2004-x64

10

Malware-1-.../5.exe

windows11-21h2-x64

10

Malware-1-...91.exe

windows10-2004-x64

10

Malware-1-...91.exe

windows11-21h2-x64

10

Malware-1-...ey.exe

windows10-2004-x64

7

Malware-1-...ey.exe

windows11-21h2-x64

7

Malware-1-...ad.exe

windows10-2004-x64

4

Malware-1-...ad.exe

windows11-21h2-x64

3

Malware-1-...ti.exe

windows10-2004-x64

5

Malware-1-...ti.exe

windows11-21h2-x64

5

Malware-1-...an.bat

windows10-2004-x64

7

Malware-1-...an.bat

windows11-21h2-x64

7

Malware-1-...an.exe

windows10-2004-x64

Malware-1-...an.exe

windows11-21h2-x64

Malware-1-...ve.bat

windows10-2004-x64

Malware-1-...ve.bat

windows11-21h2-x64

Malware-1-...ve.exe

windows10-2004-x64

10

Malware-1-...ve.exe

windows11-21h2-x64

6

Malware-1-...ya.exe

windows10-2004-x64

Malware-1-...ya.exe

windows11-21h2-x64

Malware-1-...re.exe

windows10-2004-x64

10

Malware-1-...re.exe

windows11-21h2-x64

10

Malware-1-...ry.exe

windows10-2004-x64

Malware-1-...ry.exe

windows11-21h2-x64

Malware-1-...ck.exe

windows10-2004-x64

3

Malware-1-...ck.exe

windows11-21h2-x64

3

Resubmissions

22/11/2025, 17:35

251122-v57jgsbn8x10

22/11/2025, 17:26

251122-vz93esbn4z

22/11/2025, 17:15

251122-vsrmhabm4v10

22/11/2025, 17:02

251122-vkblbavldp10

22/11/2025, 16:57

251122-vggyxsvkgr10

22/11/2025, 16:49

251122-vb6ebsbk5110

22/11/2025, 13:45

251122-q2m88aaj4t10

21/11/2025, 21:15

251121-z4cpyagj3w

12/11/2025, 03:22

251112-dw9ttaxrgx10

Sharing

Copy URL Twitter E-mail

General

  • Target
    251028-vkjxpaxrap_pw_infected.zip
  • Size 45.4MB
  • Sample251122-q2m88aaj4t
  • SHA256 6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
emotetimminentpetyawannacryxmrigadwarebankerbootkitgoogledefense_evasiondiscoveryexecutionimpactinstallerminerpersistencephishingransomwarespywarestealertrojanupxvmprotectworm

Malware Config

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

    • Target
      Malware-1-master/2530.exe
    • Size 1.2MB
    • SHA256 0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      Malware-1-master/2887140.exe
    • Size 144KB
    • SHA256 dfaf75da62d0561d171217fe893bd818a72ebfccd9d7e7f4c046f5b3ca44794e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan
    behavioral3behavioral4
    • Target
      Malware-1-master/32.exe
    • Size 1.2MB
    • SHA256 0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Drops file in System32 directory

    behavioral5behavioral6
    • Target
      Malware-1-master/5.exe
    • Size 312KB
    • SHA256 66ae33003289d8c6c3dc7c45c1b01110b4820281061292ac076b1783700a1f2d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan
    behavioral7behavioral8
    • Target
      Malware-1-master/96591.exe
    • Size 1.2MB
    • SHA256 0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Drops file in System32 directory

    behavioral10behavioral9
    • Target
      Malware-1-master/Amadey.exe
    • Size 49KB
    • SHA256 7fd898dde3a7ed047657e3dc81c3de50ed381857edc53744664332fd98476c54
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    defense_evasiondiscovery

    • Executes dropped EXE

    behavioral11behavioral12
    • Target
      Malware-1-master/Download.exe
    • Size 247KB
    • SHA256 de2274da8cf00dfc6e6e52db43f82210a1fb7fd30016ebdc81347fb2d1f248fa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral13behavioral14
    • Target
      Malware-1-master/Illuminati.exe
    • Size 1.1MB
    • SHA256 f99e4c9a4dd14d402b16e36988b72f3fe7f34b42157f756dbd14b39c70059336
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15behavioral16
    • Target
      Malware-1-master/MEMZ-Clean.bat
    • Size 9KB
    • SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral17behavioral18
    • Target
      Malware-1-master/MEMZ-Clean.exe
    • Size 12KB
    • SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryadwarespyware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral19behavioral20
    • Target
      Malware-1-master/MEMZ-Destructive.bat
    • Size 13KB
    • SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    bootkitdiscoveryexecutionpersistenceadwarespyware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral21behavioral22
    • Target
      Malware-1-master/MEMZ-Destructive.exe
    • Size 14KB
    • SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bootkitgooglediscoverypersistencephishingadwarespyware

    • Detected google phishing page

      phishinggoogle

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral23behavioral24
    • Target
      Malware-1-master/Petya.exe
    • Size 225KB
    • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bootkitpetyapersistenceransomware

    • Detects Petya Ransomware

      ransomware

    • Petya

      Petya is a ransomware written in C#.

      ransomwarepetya

    • Petya family

      petya

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral25behavioral26
    • Target
      Malware-1-master/Software.exe
    • Size 1.6MB
    • SHA256 e7f04e85236f0caafe518bd96369313021969077dba1c4a6d42e694498dab04f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryimminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Imminent family

      imminent

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral27behavioral28
    • Target
      Malware-1-master/WannaCry.EXE
    • Size 3.4MB
    • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealerworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Wannacry family

      wannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Sets desktop wallpaper using registry

      ransomware
    behavioral29behavioral30
    • Target
      Malware-1-master/Win32.EvilClusterFuck.exe
    • Size 64KB
    • SHA256 c9b98408ca67d08e1986d1855c4d99944caad5580533d18496cd8de86dd0885f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks

static1

upxinstallerminervmprotectxmrig
Score
10/10

behavioral1

bankerdiscoveryemotettrojan
Score
10/10

behavioral2

bankerdiscoveryemotettrojan
Score
10/10

behavioral3

bankerdiscoveryemotettrojan
Score
10/10

behavioral4

bankerdiscoveryemotettrojan
Score
10/10

behavioral5

bankerdiscoveryemotettrojan
Score
10/10

behavioral6

discovery
Score
5/10

behavioral7

bankerdiscoveryemotettrojan
Score
10/10

behavioral8

bankerdiscoveryemotettrojan
Score
10/10

behavioral9

bankerdiscoveryemotettrojan
Score
10/10

behavioral10

bankerdiscoveryemotettrojan
Score
10/10

behavioral11

defense_evasiondiscovery
Score
7/10

behavioral12

defense_evasiondiscovery
Score
7/10

behavioral13

discovery
Score
4/10

behavioral14

discovery
Score
3/10

behavioral15

discoveryupx
Score
5/10

behavioral16

discoveryupx
Score
5/10

behavioral17

discoveryexecution
Score
7/10

behavioral18

discoveryexecution
Score
7/10

behavioral19

discovery
Score
7/10

behavioral20

adwarediscoveryspyware
Score
5/10

behavioral21

bootkitdiscoveryexecutionpersistence
Score
7/10

behavioral22

adwarebootkitdiscoveryexecutionpersistencespyware
Score
7/10

behavioral23

bootkitgooglediscoverypersistencephishing
Score
10/10

behavioral24

adwarebootkitdiscoverypersistencespyware
Score
6/10

behavioral25

bootkitpetyapersistenceransomware
Score
10/10

behavioral26

bootkitpetyapersistenceransomware
Score
10/10

behavioral27

discoveryimminentspywaretrojan
Score
10/10

behavioral28

discoveryimminentspywaretrojan
Score
10/10

behavioral29

defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealerworm
Score
10/10

behavioral30

defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealerworm
Score
10/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10