General
- Target http://steamrip.com
- Sample260206-vwt7sse18d
Score
10/10
Malware Config
Targets
-
- Target http://steamrip.com
Score10/10-
Detects WormLocker payload
-
Modifies WinLogon for persistence
-
WormLocker
WormLocker is a ransomware written in C#.
-
Wormlocker family
-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory