Overview

overview

8

Static

static

3

Unlocker.exe

windows10-2004-x64

1

Unlocker.exe

windows11-ltsc_2024-x64

8

bz2.dll

windows10-2004-x64

1

bz2.dll

windows11-ltsc_2024-x64

8

libcurl.dll

windows10-2004-x64

1

libcurl.dll

windows11-ltsc_2024-x64

1

liblzma.dll

windows10-2004-x64

1

liblzma.dll

windows11-ltsc_2024-x64

1

zip.dll

windows10-2004-x64

1

zip.dll

windows11-ltsc_2024-x64

1

zlib1.dll

windows10-2004-x64

1

zlib1.dll

windows11-ltsc_2024-x64

1

zstd.dll

windows10-2004-x64

1

zstd.dll

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    auto-unlocker.zip
  • Size 1.0MB
  • Sample260702-e1g52abx5v
  • SHA256 aa4957c05ea0cb873db6ff2634bdd888ed9822f5db96003108ba24f2c460d23e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Targets

    • Target
      Unlocker.exe
    • Size 765KB
    • SHA256 7cfe6fa824ebc8bee0f300e0fb5e681eaef09cd22323acf6aa711495da1910a0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      bz2.dll
    • Size 75KB
    • SHA256 61c5e162d6dac796bf710e8ae848e2723135a6dac69123d55289e78b56a2fcf3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4
    • Target
      libcurl.dll
    • Size 619KB
    • SHA256 bce45020aa4448868b892412351b0fd2355bef07cf9f6f357f66123d76a301a6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      liblzma.dll
    • Size 184KB
    • SHA256 e0de297c794a8c52f43441f4370958dc5ceba3c4a0168365fc92c683cb9ea1b6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      zip.dll
    • Size 176KB
    • SHA256 4dbc3f42b466e4f01b0738599399d5af7df83688c235f0dca976c6fa4454306d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      zlib1.dll
    • Size 88KB
    • SHA256 63158ca78e53fafcf18886fbfd7d23dbc6e986f5e61a09f225bb2b42eb7a9112
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      zstd.dll
    • Size 643KB
    • SHA256 6693f11bfdf9328b58b7844b405b0f6b5a3236859261f6a51e7ad0bccdb27d1f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral13behavioral14

MITRE ATT&CK Enterprise v16

Tasks