General
- Target cookedv4.py
- Size 7KB
- Sample260601-waxapsdv5k
- SHA256 6c3a00c2c27dea6324f01ec282ffcdb2fa0c55448b0748858fde90cd9d71e4d9
- MD5 2a3ec773b108f80bf9a9795f349f322e
- SHA1 fc6427ee31e5746b9b630e2490ec9a411ffd51fb
- SHA512 ee26f3f22f63f3abb54470de7889c1732970d452f15113864fa2a4be4cc82cbacd4eeabd993dadf9bb96e931bc76d794061319ff82771d9b9808331ea0e7c119
- SSDEEP 96:0gmcFiJEcik24hKP4AlBQ6asCMQwETYSHEmXnCw/VF2312TO2/2Zk9N4:0gjlk3hKP4AlrChREmXCwtlAOT4
- TLSH T1AAE176427C652C61D343CFE68A96D642F71A7DAF1B1474387AACE2141F8947442BF4EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
Behavioral task
behavioral1
Sample
cookedv4.py
Resource
ubuntu1804-amd64-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cookedv4.py
Resource
debian9-armhf-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
cookedv4.py
Resource
debian9-mipsbe-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
cookedv4.py
Resource
debian9-mipsel-20260513-en
1 signatures
150 seconds
Malware Config
Targets
-
- Target cookedv4.py
- Size 7KB
- SHA256 6c3a00c2c27dea6324f01ec282ffcdb2fa0c55448b0748858fde90cd9d71e4d9
- MD5 2a3ec773b108f80bf9a9795f349f322e
- SHA1 fc6427ee31e5746b9b630e2490ec9a411ffd51fb
- SHA512 ee26f3f22f63f3abb54470de7889c1732970d452f15113864fa2a4be4cc82cbacd4eeabd993dadf9bb96e931bc76d794061319ff82771d9b9808331ea0e7c119
- SSDEEP 96:0gmcFiJEcik24hKP4AlBQ6asCMQwETYSHEmXnCw/VF2312TO2/2Zk9N4:0gjlk3hKP4AlrChREmXCwtlAOT4
- TLSH T1AAE176427C652C61D343CFE68A96D642F71A7DAF1B1474387AACE2141F8947442BF4EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Renames multiple (187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.