General
- Target 3798b488cc3188ae431d6583c93f86b788f7f1e719314b0e8079269284ecf87a.7z
- Size 225KB
- Sample260605-27vq2ae19x
- SHA256 1b6b6b528a7a8dd0f8068fc9165e4f6ef4cb0a1397d6fa6377a2a53818cb5f64
Score
10/10
Malware Config
Targets
-
- Target 3798b488cc3188ae431d6583c93f86b788f7f1e719314b0e8079269284ecf87a.exe
- Size 329KB
- SHA256 3798b488cc3188ae431d6583c93f86b788f7f1e719314b0e8079269284ecf87a
Score10/10-
Detects WormLocker payload
-
Family: WormLocker
WormLocker is a ransomware written in C#.
-
Modifies WinLogon for persistence
-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Modifies file permissions
-
Drops file in System32 directory