wannacry | b5146d9bc6dd446894512c2203a35375946b91f320c9779d0d5e6e83e543fb84

General

Target
d3961de88685bcad6385becf06dad8772b0a1f9f572ece4238f943f077d46d0a.zip
Size 1.9MB
Sample260705-3ak11ab12r
SHA256 b5146d9bc6dd446894512c2203a35375946b91f320c9779d0d5e6e83e543fb84
MD5 8c73d151a2d58a4b4f08b3b2a162b5c7
SHA1 4bded757d702b3ac04606b4144e59aafad6d0201
SHA512 742586b6aec60cb40fd7d6a3dea040489b2456dd58b9d1ce83f2cb8509419291fde4708bdd3a9153f1f0e53813c9000fe6abe0a55d1e30f42e530b0823dd1927
SSDEEP 49152:shmL01xqYsynEXp4C8TrP6UwCws68C2Wj:U1xJsyE2TrSUwCws6br
TLSH
T1E395335AD5EC313B3C30247491E4B6BFBCB6DA451E4525263B52CEC98CB1EA2983D4BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  d3961de88685bcad6385becf06dad8772b0a1f9f572ece4238f943f077d46d0a.zip
- Size 1.9MB
- SHA256 b5146d9bc6dd446894512c2203a35375946b91f320c9779d0d5e6e83e543fb84
- MD5 8c73d151a2d58a4b4f08b3b2a162b5c7
- SHA1 4bded757d702b3ac04606b4144e59aafad6d0201
- SHA512 742586b6aec60cb40fd7d6a3dea040489b2456dd58b9d1ce83f2cb8509419291fde4708bdd3a9153f1f0e53813c9000fe6abe0a55d1e30f42e530b0823dd1927
- SSDEEP 49152:shmL01xqYsynEXp4C8TrP6UwCws68C2Wj:U1xJsyE2TrSUwCws6br
- TLSH
  T1E395335AD5EC313B3C30247491E4B6BFBCB6DA451E4525263B52CEC98CB1EA2983D4BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  d3961de88685bcad6385becf06dad8772b0a1f9f572ece4238f943f077d46d0a.dll
- Size 5.0MB
- SHA256 d3961de88685bcad6385becf06dad8772b0a1f9f572ece4238f943f077d46d0a
- MD5 dbacc4ce4e43a588b02dc435a2d2c8f8
- SHA1 1deba14d2e141cb83dc718cce5f8ac5a18439c21
- SHA512 9117674a3b007052ee4ecf425e750cbc07cee702bf192e569917ede2234746a93e8c3b3474562c7124300e70b7c25b2bae0167475d72cdfa5017275bc02950bf
- SSDEEP 49152:RnnMSPbcBVE1INRx+TSqTdX1HkQo6SAARdhnv:1nPoBa1aRxcSUDk36SAEdhv
- TLSH
  T1C836339971BC92FCD205197080ABC923B2B27C7E56FE6E0B8B8049791D53F56B790B43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery wannacry ransomware worm
- Family: Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3353) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral3 behavioral4