cryptomix | 2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537.exe
Size 102KB
Sample260520-cskvvaf19y
SHA256 2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537
MD5 5f74d2826c1fb2b60dbf6d3de14a773d
SHA1 759b2298650613e5ba4654669b1c31ba6b1530bc
SHA512 46967e86a2f427be86b75beab51b0bbf326a40bb174296215f057a3d80eb62060f2036a6a862ec5ef1110058b4d497751d2c31730ae74cf59a9216b08ae6912d
SSDEEP 1536:RwBHJ1RDqgPUEk5eWXjfVCegA58OaIBB+LPZ6FzTwg:GBp1aEk5eWXd2IBB+LZKfwg
TLSH
T14FA32A1275E96372D422F5F007E5A252CA1FFD71D721837FEB80055B2A30E90AE36E69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware cryptomix

Malware Config

Signatures

Family: CryptoMix
Ransomware first seen in 2016 which has returned with new variants in 2019.
ransomware cryptomix

Detects CryptoMix CryptoShield variant 1 IoCs

resource	yara_rule
sample	family_cryptomix

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537.exe

File Explorer

2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537.exe

.exe 102KB

2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537.exe

IMPHASH 862f1e0e32f7ff268b72563f527a5f40
SHA256 2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537
MD5 5f74d2826c1fb2b60dbf6d3de14a773d
SHA1 759b2298650613e5ba4654669b1c31ba6b1530bc
SHA512 46967e86a2f427be86b75beab51b0bbf326a40bb174296215f057a3d80eb62060f2036a6a862ec5ef1110058b4d497751d2c31730ae74cf59a9216b08ae6912d
SSDEEP 1536:RwBHJ1RDqgPUEk5eWXjfVCegA58OaIBB+LPZ6FzTwg:GBp1aEk5eWXd2IBB+LZKfwg
TLSH
T14FA32A1275E96372D422F5F007E5A252CA1FFD71D721837FEB80055B2A30E90AE36E69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects CryptoMix CryptoShield variant
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapAlloc WriteConsoleA WriteFileEx InitializeCriticalSectionAndSpinCount GetProfileStringW CompareStringW GlobalMemoryStatus WaitForMultipleObjects GetUserDefaultLCID lstrcmpW CreateFileW IsValidCodePage DeleteFileW GetOverlappedResult FreeEnvironmentStringsW ReadFile GetSystemTimeAsFileTime GetOEMCP lstrcpynA SetEndOfFile ExitThread GetVersion SizeofResource FindFirstFileW VirtualAlloc GetModuleHandleW WriteConsoleW HeapDestroy GetFullPathNameA InitializeCriticalSection EnumSystemLocalesA FindFirstFileA MultiByteToWideChar SetHandleCount TlsSetValue GetStdHandle GetTimeFormatW UnmapViewOfFile GetStringTypeA LCMapStringA GetLocaleInfoA HeapSize RtlUnwind HeapReAlloc GetCPInfo EnterCriticalSection LeaveCriticalSection GetTickCount QueryPerformanceCounter HeapFree VirtualFree InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsAlloc DeleteCriticalSection GetEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings FreeEnvironmentStringsA WriteFile ExitProcess Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoA GetCommandLineA LocalUnlock CreateFileMappingW GetCurrentThreadId GetProcessHeap GetProfileIntW HeapCreate GlobalReAlloc GetTimeZoneInformation TerminateThread GetDateFormatA CompareStringA SetFilePointer SearchPathA TlsGetValue LCMapStringW SetEnvironmentVariableA GetCurrentProcessId DosDateTimeToFileTime GetFileType FindResourceW LockResource VirtualAllocEx GetLastError GetModuleFileNameA GetACP GetCurrentProcess GetModuleHandleA LoadLibraryA GetStringTypeW GetProcAddress

user32

OpenClipboard GetFocus DrawFocusRect SetScrollPos IsZoomed LoadCursorW DispatchMessageA DrawTextExW IsClipboardFormatAvailable SetDlgItemInt RegisterWindowMessageW SystemParametersInfoW LoadMenuW RegisterClassExW MapWindowPoints SetCursorPos OpenDesktopA SetWindowPos GetClipboardData OffsetRect GetParent GetMenuCheckMarkDimensions SetWindowLongW GetWindowPlacement SetMenu MsgWaitForMultipleObjects DefWindowProcW MessageBoxW LoadStringW GetSystemMenu GetSystemMetrics CharNextA GetDlgItemTextA HideCaret InflateRect ChildWindowFromPoint CharUpperW GetSubMenu DestroyMenu IsDialogMessageA PostMessageW DialogBoxIndirectParamA CheckRadioButton SendDlgItemMessageW wsprintfW BeginPaint DialogBoxParamW DrawTextW SetTimer EndDialog SetWindowLongA LoadCursorA InvalidateRect DialogBoxParamA FindWindowA GetCursorPos GetWindowTextW

gdi32

TextOutW GetTextMetricsA EndPage SetMapMode CreateFontIndirectW GetTextFaceW GetObjectA GetTextExtentPointA StartDocW StartPage GetTextExtentPoint32W GetObjectW SelectObject

winspool.drv

OpenPrinterW

comdlg32

GetFileTitleW ChooseFontW PrintDlgA CommDlgExtendedError

advapi32

RegSetValueExA OpenServiceA OpenSCManagerA RegOpenKeyExA RegQueryValueExW RegDeleteValueA RegCreateKeyA OpenProcessToken GetTokenInformation AllocateAndInitializeSid

shell32

ShellExecuteA DragAcceptFiles CommandLineToArgvW ShellExecuteExA