Overview

overview

10

Static

static

3

Rc.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Rc.exe
  • Size 6.1MB
  • Sample260710-m73pbaa18w
  • SHA256 dd96f50438f1a0180b1f41b462986f2479897336fb4ec9d4985cd17ea258a7be
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionransomware

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://i.imgur.com/vu5qS42.png

Extracted

Path

  • C:\Decryption Instructions.txt

Ransom Note
  • ---------- ZeroDay Locker ---------- Your files have been encrypted using ZeroDay Ransomware! They can only be decrypted by paying us a ransom in cryptocurrency. Encrypted files have the .zeroday extension. IMPORTANT: Do not modify or rename encrypted files, as they may become unrecoverable. Contact us via session to discuss payment. OUR ACCOUNT ID: 05a0baf9597134bd2048de058ca9f4603086d955d5014e73d427b89b3b82493276 ---------- EByteLocker ----------

Targets

    • Target
      Rc.exe
    • Size 6.1MB
    • SHA256 dd96f50438f1a0180b1f41b462986f2479897336fb4ec9d4985cd17ea258a7be
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionransomware

    • Renames multiple (206) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks