Overview

overview

10

Static

static

10

Malware_sa...14.dll

windows11-21h2-x64

10

Malware_sa...7.docx

windows11-21h2-x64

1

Malware_sa...13.exe

windows11-21h2-x64

10

Malware_sa...1c.exe

windows11-21h2-x64

10

Malware_sa...434.js

windows11-21h2-x64

8

Resubmissions

15/02/2026, 11:59

260215-n55lkacs8a

11/02/2026, 08:12

260211-j3tn3ac14f10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Malware_sample.zip.zip
  • Size 4.9MB
  • Sample260211-j3tn3ac14f
  • SHA256 eed4fcb518584191d93eb04b4917fe55f3c7ac7ac3288c0ac56bc8cadefe69b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
funklockermiraiwannacryenigmaExecutiondefense_evasiondiscoveryexecutionimpactransomwareworm

Malware Config

Extracted

Family

  • mirai

Botnet

  • ENIGMA

Targets

    • Target
      Malware_sample/Windows/dll/b0e30d10f4286ad0385e153ad92aada9dd80dac64fc12a5136836bdc7d693014.dll
    • Size 5.0MB
    • SHA256 b0e30d10f4286ad0385e153ad92aada9dd80dac64fc12a5136836bdc7d693014
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverywannacryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Wannacry family

      wannacry

    • Contacts a large (3305) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1
    • Target
      Malware_sample/Windows/docx/2ad6ca5c2471a53baebf2d1735ff9fbfe5d6a76d963e990d75098f66cf668257.docx
    • Size 638KB
    • SHA256 2ad6ca5c2471a53baebf2d1735ff9fbfe5d6a76d963e990d75098f66cf668257
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      Malware_sample/Windows/exe/WannaCry_13.exe
    • Size 6.4MB
    • SHA256 8b8f390300b2dac722ec43061e04a0f24a570e2c9107d7aba8e9b05a6b1e5c16
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoverywannacryransomwareworm
    behavioral3
    • Target
      Malware_sample/Windows/exe/c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe.bin
    • Size 5.2MB
    • SHA256 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    Executiondefense_evasionexecutionfunklockerimpactransomware

    • FunkLocker

      FunkLocker is a ransomware attributed to FunkSec group.

      ransomwarefunklocker

    • Funklocker family

      funklocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Disables Windows Security event logs

      Uses wevtutil to disable the Windows Security event logs, preventing new Security events from being recorded and reducing audit trail visibility.

      defense_evasion

    • Disables one or more Microsoft Defender components

      Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

      defense_evasion

    • Disables Windows Application event log

      Uses wevtutil to disable the Windows Application event log, preventing new Application events from being recorded and interfering with incident detection and investigation.

      defense_evasion

    • Stops running service(s)

      defense_evasionexecution

    • Temporarily bypasses Powershell execution policy

      Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

      Execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in System32 directory

    behavioral4
    • Target
      Malware_sample/Windows/js/dcaf11f797416cf83508885951514ee6d1db4e6401c11a2b62756a2dba739434.js
    • Size 75KB
    • SHA256 dcaf11f797416cf83508885951514ee6d1db4e6401c11a2b62756a2dba739434
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    behavioral5

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

JavaScript

1
T1059.007

PowerShell

2
T1059.001

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Direct Volume Access

1
T1006

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

4
T1562

Disable Windows Event Logging

2
T1562.002

Disable or Modify Tools

1
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Credential Access

Discovery

Network Service Discovery

2
T1046

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Service Stop

1
T1489

Tasks