Overview

overview

7

Static

static

3

v1.8.0/Exitlag.dll

windows10-2004-x64

1

v1.8.0/Exitlag.dll

windows11-ltsc_2024-x64

1

v1.8.0/README.txt

windows10-2004-x64

1

v1.8.0/README.txt

windows11-ltsc_2024-x64

1

v1.8.0/aut...ted.py

windows10-2004-x64

3

v1.8.0/aut...ted.py

windows11-ltsc_2024-x64

3

v1.8.0/cre...ts.txt

windows10-2004-x64

1

v1.8.0/cre...ts.txt

windows11-ltsc_2024-x64

1

v1.8.0/exitloader.exe

windows10-2004-x64

3

v1.8.0/exitloader.exe

windows11-ltsc_2024-x64

3

v1.8.0/exi...xe.lnk

windows10-2004-x64

7

v1.8.0/exi...xe.lnk

windows11-ltsc_2024-x64

3

v1.8.0/pyt...er.bat

windows10-2004-x64

3

v1.8.0/pyt...er.bat

windows11-ltsc_2024-x64

3

v1.8.0/req...ts.txt

windows10-2004-x64

1

v1.8.0/req...ts.txt

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    v1.8.0.zip
  • Size 132KB
  • Sample260718-xdx7vadv6s
  • SHA256 367378788bab0a2dec974931c0e76a424bf18ec2a63b13984135353565ab77e4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionpersistenceransomware

Malware Config

Targets

    • Target
      v1.8.0/Exitlag.dll
    • Size 29KB
    • SHA256 621bff60b096f55b4b56637b68f3a53de3bfa7742fe91c75e35e41e8bf3dd2e1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      v1.8.0/README.txt
    • Size 1KB
    • SHA256 c1a17bddc4eb3dfd4751c5826360c8cd1ab59aad0ba1e0bac6fe023056d72134
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    ransomware
    behavioral3behavioral4
    • Target
      v1.8.0/auto_signup_updated.py
    • Size 10KB
    • SHA256 ab43d25119556159d5d372fb181418913bd21903203de4516bd76ac42f459da4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      v1.8.0/created_accounts.txt
    • Size 34B
    • SHA256 9e87d2d2881731c8146e324a0399012b7045fedfdf46de458d7fed22899cf245
    • MD5 SHA1 SHA512
    Score
    1/10
    ransomware
    behavioral7behavioral8
    • Target
      v1.8.0/exitloader.exe
    • Size 573KB
    • SHA256 b3eb5fa950f798e33eb40b2740a9a21adb031542372c17a7b4aa381f605ba7cf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    executionpersistence
    behavioral10behavioral9
    • Target
      v1.8.0/exitloader.exe.lnk
    • Size 1KB
    • SHA256 0f2ff612e9157a4c03d69837c4169f7446a447a7f5d14b419588078254dc2912
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    executionpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral11behavioral12
    • Target
      v1.8.0/python_installer.bat
    • Size 2KB
    • SHA256 7f1c7b7ad7ca50c8fec69bd79ae0ffbd2d9252332f3618f53bffc10a74c3fc19
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      v1.8.0/requirements.txt
    • Size 50B
    • SHA256 1304c882058fe13339c20f0c43bda1e63cb55c67e0f6e75ae9a5cc45189d93a4
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    ransomware
    behavioral15behavioral16

MITRE ATT&CK Enterprise v16

Tasks