41cbd0bc2fbb865cb1717137883fedcdd0a723d6943fc3395e58e8a80da796a9

General

Target
test.zip
Size 471KB
Sample260620-159lqsaz21
SHA256 41cbd0bc2fbb865cb1717137883fedcdd0a723d6943fc3395e58e8a80da796a9
MD5 ba82a526efaad214a43acf3298cfa5d0
SHA1 91f2a15a9f0dc3a44bc348eecf4d863112199384
SHA512 f9676a626946bbeb2f603e84d91acd99cde0fa60aedb0730172aa71a11f088613dd2520b2fc3b7d0f30ccd2c2a011729f087f8e0ff552d63511d8e4e2713bb87
SSDEEP 12288:KiRwxr4zKWI2vOBHHtgIMqIO/N/Dz7bAEfvNxQ:KRk+VzBHHtBYOFf7bAQxQ
TLSH
T1BEA4234BFE4AD3D937F204F64F18D65C24A250A05F9FA446FC572E982BDAC072BC4992
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  test.zip
- Size 471KB
- SHA256 41cbd0bc2fbb865cb1717137883fedcdd0a723d6943fc3395e58e8a80da796a9
- MD5 ba82a526efaad214a43acf3298cfa5d0
- SHA1 91f2a15a9f0dc3a44bc348eecf4d863112199384
- SHA512 f9676a626946bbeb2f603e84d91acd99cde0fa60aedb0730172aa71a11f088613dd2520b2fc3b7d0f30ccd2c2a011729f087f8e0ff552d63511d8e4e2713bb87
- SSDEEP 12288:KiRwxr4zKWI2vOBHHtgIMqIO/N/Dz7bAEfvNxQ:KRk+VzBHHtBYOFf7bAQxQ
- TLSH
  T1BEA4234BFE4AD3D937F204F64F18D65C24A250A05F9FA446FC572E982BDAC072BC4992
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  alpushka-ransomlab.exe
- Size 1.2MB
- SHA256 e1745a9a67903c13fce7b39090039ca538aefcf8d801d0e7fbfff545156c135a
- MD5 756279abed3a42389ec11caf1dc0b13c
- SHA1 2d0d19d0189af096735d9cf542285c39cfe9dd67
- SHA512 0f946ec03c8ad5420a39bd75560ff005c64e257339ab4589bcac4f8690253ded88e858bd1c8c4fdc80f0bdf2c2b48d7bc7073b858df0f5d11bb2401a2888201a
- SSDEEP 24576:UsUwQCTp2CC38WsPAY8VqhtUqGAhnyg+1p:UsBQCTp2CCBWAY8eSqGAhnyg+1p
- TLSH
  T1A3555B62A5895AAED303D03981A7963A753532C92333BFB31D9DDE306F82DC54F2531A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery ransomware
- Renames multiple (747) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
behavioral2