Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged/Fantom.exe
  • Size 261KB
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 7d80230df68ccba871815d68f016c282
  • SHA1 e10874c6108a26ceedfc84f50881824462b5b6b6
  • SHA512 64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
  • SSDEEP 3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
  • TLSH
    T10844D01071C1C2B3C4B7113488E5CB759E7A347247BA95D7B6DD2ABA6E103D1A3362CE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryfantomransomware

  • Family: Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom

  • Renames multiple (1262) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2
• • Target
    Red-Flaged/HermeticWiper.exe
  • Size 114KB
  • SHA256 2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf
  • MD5 382fc1a3c5225fceb672eea13f572a38
  • SHA1 d9a3596af0463797df4ff25b7999184946e3bfa2
  • SHA512 0fa729f6834d475f787634cc69592633c32a0368c63abac5f702bdd8fd838ad9ceb50941448518a3bf1da0ab45bf6b0dac42d99168d51916591277db19dedacd
  • SSDEEP 1536:bV3+WmNcWDurilmw9BgjKu1sPPxaS4jqY:bV3+WmjDxlPwV16PkS4jqY
  • TLSH
    T12FB325539AEC3CC6D47913B137BFA3E5D32EECA46A90C09E96D01182D57C5933A227E4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discovery

  • Drops file in Drivers directory

  • Executes dropped EXE

  behavioral3behavioral4
• • Target
    Red-Flaged/InfinityCrypt.exe
  • Size 211KB
  • SHA256 f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
  • MD5 b805db8f6a84475ef76b795b0d1ed6ae
  • SHA1 7711cb4873e58b7adcf2a2b047b090e78d10c75b
  • SHA512 62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416
  • SSDEEP 1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbM:rCVC303p22sZrRQpnviB832Du9WMON
  • TLSH
    T112245E02774ACE78F9A80AB98D62D23C43E57D0357028A2939EB7DCB77333E15A47519
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryinfinitylockransomware

  • Family: InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock
  behavioral5behavioral6
• • Target
    Red-Flaged/Petya.A.exe
  • Size 225KB
  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
  • MD5 af2379cc4d607a45ac44d62135fb7015
  • SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
  • SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
  • SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
  • TLSH
    T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitpetyapersistenceransomware

  • Detects Petya Ransomware

    ransomware

  • Family: Petya

    Petya is a ransomware written in C#.

    ransomwarepetya

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral7behavioral8