Overview

overview

10

Static

static

8

Ransomware...er.exe

windows11-21h2-x64

8

Ransomware/7ev3n.exe

windows11-21h2-x64

Ransomware...le.exe

windows11-21h2-x64

Ransomware...it.exe

windows11-21h2-x64

10

Ransomware/Birele.exe

windows11-21h2-x64

5

Ransomware...r5.exe

windows11-21h2-x64

8

Ransomware...us.exe

windows11-21h2-x64

3

Ransomware...er.exe

windows11-21h2-x64

10

Ransomware...ll.exe

windows11-21h2-x64

7

Ransomware...ck.exe

windows11-21h2-x64

7

Ransomware/Dharma.exe

windows11-21h2-x64

9

Ransomware/Fantom.exe

windows11-21h2-x64

3

Ransomware...ab.exe

windows11-21h2-x64

3

Ransomware...ye.exe

windows11-21h2-x64

10

Ransomware...Eye.js

windows11-21h2-x64

Ransomware...pt.exe

windows11-21h2-x64

4

Ransomware...en.exe

windows11-21h2-x64

8

Ransomware...AZ.dll

windows11-21h2-x64

3

Ransomware...om.exe

windows11-21h2-x64

10

Ransomware...ya.exe

windows11-21h2-x64

10

Ransomware...ap.exe

windows11-21h2-x64

3

Ransomware....A.exe

windows11-21h2-x64

Ransomware...om.exe

windows11-21h2-x64

10

Ransomware...nt.exe

windows11-21h2-x64

Ransomware...ot.exe

windows11-21h2-x64

Ransomware/RedEye.exe

windows11-21h2-x64

Ransomware...re.exe

windows11-21h2-x64

7

Ransomware/Rokku.exe

windows11-21h2-x64

10

Ransomware/Satana.exe

windows11-21h2-x64

5

Ransomware/Seftad.exe

windows11-21h2-x64

6

Ransomware...re.exe

windows11-21h2-x64

10

Ransomware/UIWIX.dll

windows11-21h2-x64

3

Resubmissions

08/09/2026, 17:42

260908-v91lqsvzby10

08/09/2026, 14:47

260908-r5xshastaw

06/09/2026, 10:46

260906-mtz19shn5s10

02/09/2026, 16:53

260902-vefcbaxhjb10

02/09/2026, 16:53

260902-vd1xmaxgqd

26/04/2026, 11:25

260426-njgydaas6r10

24/04/2026, 20:04

260424-ys8gssbv3l10

20/04/2026, 09:05

260420-k2f71sdx8l10

19/04/2026, 23:18

260419-3ae5racv4n10

19/04/2026, 18:21

260419-wzn1mafy4p10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Ransomware.zip
  • Size 49.9MB
  • Sample260420-k2f71sdx8l
  • SHA256 72f6748f1c16b750d00541597668e5c306f77759dc998f65f33fe94b8c765b90
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
badrabbitcryptolockermetasploitmimikatznabucurpetyaseventroldeshadwarebackdoorbootkitdefense_evasiondiscoveryevasionexecutionimpactlateral_movementpersistenceprivilege_escalationransomwarerevoked_codesignspywarestealersuricatatrojanupx

Malware Config

Extracted

Family

  • metasploit

Version

  • windows/single_exec

Extracted

Path

  • C:\Users\Admin\README_HOW_TO_UNLOCK.TXT

Ransom Note
  • YOUR FILE HAS BEEN LOCKED In order to unlock your files, follow the instructions bellow: 1. Download and install Tor Browser 2. After a successful installation, run Tor Browser and wait for its initialization. 3. Type in the address bar: http://zvnvp2rhe3ljwf2m.onion 4. Follow the instructions on the site.
URLs

  • http://zvnvp2rhe3ljwf2m.onion

Targets

    • Target
      Ransomware/$uckyLocker.exe
    • Size 414KB
    • SHA256 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryransomware
    behavioral1
    • Target
      Ransomware/7ev3n.exe
    • Size 315KB
    • SHA256 7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionsevenpersistenceransomwaretrojan
    behavioral2
    • Target
      Ransomware/Annabelle.exe
    • Size 15.9MB
    • SHA256 716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan
    behavioral3
    • Target
      Ransomware/BadRabbit.exe
    • Size 431KB
    • SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionbadrabbitmimikatzpersistenceransomware

    • Family: BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Family: Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral4
    • Target
      Ransomware/Birele.exe
    • Size 116KB
    • SHA256 b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral5
    • Target
      Ransomware/Cerber5.exe
    • Size 313KB
    • SHA256 b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoverypersistenceprivilege_escalation

    • Contacts a large (575) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Windows Firewall

      defense_evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral6
    • Target
      Ransomware/CoronaVirus.exe
    • Size 1.0MB
    • SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7
    • Target
      Ransomware/CryptoLocker.exe
    • Size 338KB
    • SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverycryptolockerpersistenceransomware

    • Family: CryptoLocker

      Ransomware family with multiple variants.

      ransomwarecryptolocker

    • Deletes itself

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral8
    • Target
      Ransomware/CryptoWall.exe
    • Size 132KB
    • SHA256 e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistence

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral9
    • Target
      Ransomware/DeriaLock.exe
    • Size 484KB
    • SHA256 4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Drops startup file

    behavioral10
    • Target
      Ransomware/Dharma.exe
    • Size 11.5MB
    • SHA256 6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoverylateral_movementpersistenceprivilege_escalation

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Remote Service Session Hijacking: RDP Hijacking

      Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

      lateral_movement

    • Modifies Windows Firewall

      defense_evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Modifies visibility of existing users in the login screen

      A user account was hidden or made visible on the Windows login screen through a registry modification.

      defense_evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Password Policy Discovery

      Attempt to access detailed information about the password policy used within an enterprise network.

      discovery
    behavioral11
    • Target
      Ransomware/Fantom.exe
    • Size 261KB
    • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral12
    • Target
      Ransomware/GandCrab.exe
    • Size 291KB
    • SHA256 bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13
    • Target
      Ransomware/GoldenEye/GoldenEye.exe
    • Size 254KB
    • SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoorbootkitdiscoverymetasploitpersistencetrojan

    • Family: MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral14
    • Target
      Ransomware/GoldenEye/GoldenEye.js
    • Size 365KB
    • SHA256 28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoorbootkitdiscoveryexecutionmetasploitpersistencetrojan

    • Family: MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral15
    • Target
      Ransomware/InfinityCrypt.exe
    • Size 211KB
    • SHA256 f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral16
    • Target
      Ransomware/Krotten.exe
    • Size 53KB
    • SHA256 e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwaredefense_evasiondiscoverypersistencespywarestealer
    behavioral17
    • Target
      Ransomware/Locky.AZ.exe
    • Size 181KB
    • SHA256 2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral18
    • Target
      Ransomware/NoMoreRansom.exe
    • Size 1.4MB
    • SHA256 2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutiontroldeshimpactpersistenceransomwarespywarestealersuricatatrojanupx

    • Family: Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

      Network activity triggered a Suricata alert

      suricata

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral19
    • Target
      Ransomware/NotPetya.exe
    • Size 390KB
    • SHA256 63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bootkitdiscoveryexecutionmimikatzpersistencespywarestealer

    • Family: Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral20
    • Target
      Ransomware/PetrWrap
    • Size 473KB
    • SHA256 e079fa28ea51fa98644164caf585ae3231d25372fccca1245902fb57488d4660
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21
    • Target
      Ransomware/Petya.A.exe
    • Size 225KB
    • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bootkitpetyapersistenceransomware

    • Detects Petya Ransomware

      ransomware

    • Family: Petya

      Petya is a ransomware written in C#.

      ransomwarepetya

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral22
    • Target
      Ransomware/PolyRansom.exe
    • Size 220KB
    • SHA256 1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoverynabucurpersistenceransomwarespywarestealertrojan

    • Family: Nabucur

      Nabucur is a ransomware first seen in 2015.

      ransomwarenabucur

    • Modifies visibility of file extensions in Explorer

      defense_evasion

    • UAC bypass

      defense_evasiontrojan

    • Renames multiple (118) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral23
    • Target
      Ransomware/PowerPoint.exe
    • Size 136KB
    • SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    bootkitdiscoverypersistence

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral24
    • Target
      Ransomware/RedBoot.exe
    • Size 1.2MB
    • SHA256 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    bootkitdiscoverypersistenceransomwareupx

    • Renames multiple (157) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral25
    • Target
      Ransomware/RedEye.exe
    • Size 10.6MB
    • SHA256 9ac9f207060c28972ede6284137698ce0769e3695c7ad98ab320605d23362305
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan
    behavioral26
    • Target
      Ransomware/Rensenware.exe
    • Size 96KB
    • SHA256 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral27
    • Target
      Ransomware/Rokku.exe
    • Size 666KB
    • SHA256 438888ef36bad1079af79daf152db443b4472c5715a7b3da0ba24cc757c53499
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionimpactransomwareupx

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (79) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral28
    • Target
      Ransomware/Satana.exe
    • Size 49KB
    • SHA256 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discovery

    • Suspicious use of SetThreadContext

    behavioral29
    • Target
      Ransomware/Seftad.exe
    • Size 48KB
    • SHA256 2ebe23ba9897d9c127b9c0a737ba63af8d0bcd76ec866610cc0b5de2f62b87bd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdiscoverypersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral30
    • Target
      Ransomware/SporaRansomware.exe
    • Size 24KB
    • SHA256 7ad9ed23a91643b517e82ad5740d24eca16bcae21cfe1c0da78ee80e0d1d3f02
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral31
    • Target
      Ransomware/UIWIX.exe
    • Size 211KB
    • SHA256 146581f0b3fbe00026ee3ebe68797b0e57f39d1d8aecc99fdc3290e9cfadc4fc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

5
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

2
T1546

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

5
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

2
T1546

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

Hide Artifacts

4
T1564

Hidden Files and Directories

3
T1564.001

Hidden Users

1
T1564.002

Impair Defenses

5
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

3
T1562.001

Safe Mode Boot

1
T1562.009

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

14
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Password Policy Discovery

1
T1201

Peripheral Device Discovery

1
T1120

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Query Registry

3
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Remote Service Session Hijacking

1
T1563

RDP Hijacking

1
T1563.002

Replication Through Removable Media

1
T1091

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

4
T1490

Tasks

static1

revoked_codesignupx
Score
8/10

behavioral1

defense_evasiondiscoveryransomware
Score
8/10

behavioral2

defense_evasiondiscoveryevasionexecutionsevenpersistenceransomwaretrojan
Score
10/10

behavioral3

defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan
Score
10/10

behavioral4

discoveryexecutionbadrabbitmimikatzpersistenceransomware
Score
10/10

behavioral5

discoveryupx
Score
5/10

behavioral6

defense_evasiondiscoverypersistenceprivilege_escalation
Score
8/10

behavioral7

discovery
Score
3/10

behavioral8

discoverycryptolockerpersistenceransomware
Score
10/10

behavioral9

discoverypersistence
Score
7/10

behavioral10

discovery
Score
7/10

behavioral11

defense_evasiondiscoverylateral_movementpersistenceprivilege_escalation
Score
9/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

backdoorbootkitdiscoverymetasploitpersistencetrojan
Score
10/10

behavioral15

backdoorbootkitdiscoveryexecutionmetasploitpersistencetrojan
Score
10/10

behavioral16

discovery
Score
4/10

behavioral17

adwaredefense_evasiondiscoverypersistencespywarestealer
Score
8/10

behavioral18

discovery
Score
3/10

behavioral19

defense_evasiondiscoveryexecutiontroldeshimpactpersistenceransomwarespywarestealersuricatatrojanupx
Score
10/10

behavioral20

bootkitdiscoveryexecutionmimikatzpersistencespywarestealer
Score
10/10

behavioral21

discovery
Score
3/10

behavioral22

bootkitpetyapersistenceransomware
Score
10/10

behavioral23

defense_evasiondiscoverynabucurpersistenceransomwarespywarestealertrojan
Score
10/10

behavioral24

bootkitdiscoverypersistence
Score
7/10

behavioral25

bootkitdiscoverypersistenceransomwareupx
Score
9/10

behavioral26

defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan
Score
10/10

behavioral27

spywarestealer
Score
7/10

behavioral28

defense_evasiondiscoveryexecutionimpactransomwareupx
Score
10/10

behavioral29

discovery
Score
5/10

behavioral30

bootkitdiscoverypersistence
Score
6/10

behavioral31

defense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer
Score
10/10

behavioral32

discovery
Score
3/10