cryptolocker | 189b1a6de3c2ee65ccbc2c0691bf6b2c63c8905e1a58e164b1113bef7f24d458

General

Target
Screenshot 2026-06-02 172705.png
Size 40KB
Sample260620-gc4p8sdt2p
SHA256 189b1a6de3c2ee65ccbc2c0691bf6b2c63c8905e1a58e164b1113bef7f24d458
MD5 215f95f37fa7f7ee3a5f55fa2d02e5bb
SHA1 a090d29a80860ab94528a22a637289cf1098772d
SHA512 2409c7d8ccb47d15c808a1f76f43023dc8dcc682a84493448d0e6b8fe845698ce6cb948821c8bdc0f3f569f7be25b1762e587e4fc99360c6ce73e2bbbaf94bf1
SSDEEP 768:OuxGDNGEeyOLpCJlMyoXcRS9tgXOHWnYQE8sFs+gwYdJyRGPmAvtUQ8I:OuIepAsgXUW+prcJysOmtUBI
TLSH
T11F13028B26AB40EF5BDC9E29763670E46F411F1E2BB0571785A90AB9C101FF2870F52D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Screenshot 2026-06-02 172705.png
- Size 40KB
- SHA256 189b1a6de3c2ee65ccbc2c0691bf6b2c63c8905e1a58e164b1113bef7f24d458
- MD5 215f95f37fa7f7ee3a5f55fa2d02e5bb
- SHA1 a090d29a80860ab94528a22a637289cf1098772d
- SHA512 2409c7d8ccb47d15c808a1f76f43023dc8dcc682a84493448d0e6b8fe845698ce6cb948821c8bdc0f3f569f7be25b1762e587e4fc99360c6ce73e2bbbaf94bf1
- SSDEEP 768:OuxGDNGEeyOLpCJlMyoXcRS9tgXOHWnYQE8sFs+gwYdJyRGPmAvtUQ8I:OuIepAsgXUW+prcJysOmtUBI
- TLSH
  T11F13028B26AB40EF5BDC9E29763670E46F411F1E2BB0571785A90AB9C101FF2870F52D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution cryptolocker dharma hiddentear troldesh impact persistence ransomware spyware trojan upx
- Detects HiddenTear Ransomware
- Family: CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Family: Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Family: HiddenTear, Cryptear
  HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
  ransomware hiddentear
- Family: Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (53) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1