bxbd_ransomware | dda001570acbc9c366a007e4207d5b7cda07c61d1583449869db2c80d52e8e41

General

Target
dda001570acbc9c366a007e4207d5b7cda07c61d1583449869db2c80d52e8e41
Size 564KB
Sample260413-jwv9baft7m
SHA256 dda001570acbc9c366a007e4207d5b7cda07c61d1583449869db2c80d52e8e41
MD5 30188cb23da5e8939089ca948258e635
SHA1 f4f2f97fab0bca00635f293c1d26ad8abc83bf0e
SHA512 746ac65a05ce98e7e7780cc44a385a9d53155d4765ad8924dd929d797d0f4938c9618eec9b7f55a8377671cd6f0607c1a9063d412d95a396bdf5bbe1d03a9de4
SSDEEP 12288:45Ll51M2fc6WcWXDaPywencii/tZOv2L6SRE0Ilg:C522cIG2SncXPQ2Lg
TLSH
T182C4E0191BFC1D26DBF9037981BA1850AB727915FA83F38F672269E53E62310D91132F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  dda001570acbc9c366a007e4207d5b7cda07c61d1583449869db2c80d52e8e41
- Size 564KB
- SHA256 dda001570acbc9c366a007e4207d5b7cda07c61d1583449869db2c80d52e8e41
- MD5 30188cb23da5e8939089ca948258e635
- SHA1 f4f2f97fab0bca00635f293c1d26ad8abc83bf0e
- SHA512 746ac65a05ce98e7e7780cc44a385a9d53155d4765ad8924dd929d797d0f4938c9618eec9b7f55a8377671cd6f0607c1a9063d412d95a396bdf5bbe1d03a9de4
- SSDEEP 12288:45Ll51M2fc6WcWXDaPywencii/tZOv2L6SRE0Ilg:C522cIG2SncXPQ2Lg
- TLSH
  T182C4E0191BFC1D26DBF9037981BA1850AB727915FA83F38F672269E53E62310D91132F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit bxbd_ransomware impact persistence ransomware spyware stealer
- BXBD Ransomware
  BXBD Ransomware is a Windows ransomware written in C#.
  ransomware bxbd_ransomware
- Bxbd_ransomware family
  bxbd_ransomware
- Detects BXBD ransomware
- Modifies WinLogon for persistence
  persistence
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2