badrabbit | 92871c72c5ffe83d48df3b3333b7c31b7aa0b4e1a617f6223367ba7078f70a50

General

Target
Launcher.exe
Size 1.1MB
Sample260729-a9qfjsdn9x
SHA256 92871c72c5ffe83d48df3b3333b7c31b7aa0b4e1a617f6223367ba7078f70a50
MD5 88abc4685e9d179bb9d461042cc4583e
SHA1 6a59721b84406648edfaec302c148db608c632e1
SHA512 c09c1fc4fe1dd913d0777e134a6516c9bcbfe4327f058509be354357c5f0dfc3af79bbc1283e980bca94e38a6f24246f3131b6b466b4afb1896267c4a2057bfa
SSDEEP 12288:VZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGiOvPqItNquB:Vcb4M06WpoPrwevP3f5
TLSH
T168357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Launcher.exe
- Size 1.1MB
- SHA256 92871c72c5ffe83d48df3b3333b7c31b7aa0b4e1a617f6223367ba7078f70a50
- MD5 88abc4685e9d179bb9d461042cc4583e
- SHA1 6a59721b84406648edfaec302c148db608c632e1
- SHA512 c09c1fc4fe1dd913d0777e134a6516c9bcbfe4327f058509be354357c5f0dfc3af79bbc1283e980bca94e38a6f24246f3131b6b466b4afb1896267c4a2057bfa
- SSDEEP 12288:VZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGiOvPqItNquB:Vcb4M06WpoPrwevP3f5
- TLSH
  T168357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution badrabbit hiddentear mimikatz seven troldesh impact persistence privilege_escalation ransomware trojan upx
- Detects HiddenTear Ransomware
- Family: BadRabbit
  Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
  ransomware badrabbit
- Family: HiddenTear, Cryptear
  HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
  ransomware hiddentear
- Family: Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Family: Seven, SevenCrypt, 7ev3n
  Seven aka SevenCrypt or 7ev3n is a ransomware.
  ransomware seven
- Family: Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- mimikatz is an open source tool to dump credentials on Windows
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2