badrabbit | e35877395ee85c1bbd4d71ef969e802a8913cfd797ef1566146b3dddbee6f8cf

General

Target
download (5).jpg
Size 3KB
Sample260821-cfbfmsep7x
SHA256 e35877395ee85c1bbd4d71ef969e802a8913cfd797ef1566146b3dddbee6f8cf
MD5 918d491eabd0b6ca63f557d94a0368fe
SHA1 92a65fee3b01a34abae937eab819d97aa0068c09
SHA512 2f625a1fc9918c541f377ac819fa06fa984dff38a057388970a14115093b761309f2fc6fd34561b8b37f4ce09452d9a7dc8d9d94ee119a69f6322309487b7ffb
TLSH
T138713B1A9BD84E92C6645BBC347B15AC1EFB35705A464EEB8084E4C8F8E88D393254D2
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Targets

- Target
  download (5).jpg
- Size 3KB
- SHA256 e35877395ee85c1bbd4d71ef969e802a8913cfd797ef1566146b3dddbee6f8cf
- MD5 918d491eabd0b6ca63f557d94a0368fe
- SHA1 92a65fee3b01a34abae937eab819d97aa0068c09
- SHA512 2f625a1fc9918c541f377ac819fa06fa984dff38a057388970a14115093b761309f2fc6fd34561b8b37f4ce09452d9a7dc8d9d94ee119a69f6322309487b7ffb
- TLSH
  T138713B1A9BD84E92C6645BBC347B15AC1EFB35705A464EEB8084E4C8F8E88D393254D2
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution badrabbit hiddentear persistence privilege_escalation ransomware spyware stealer trojan
- Detects HiddenTear Ransomware
- Family: BadRabbit
  Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
  ransomware badrabbit
- Family: HiddenTear, Cryptear
  HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
  ransomware hiddentear
- Suspicious use of NtCreateProcessExOtherParentProcess
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Sets desktop wallpaper using registry
  ransomware
behavioral1