General

  • Target
    2026-08-21_78d9192ce754adcd0ee58cd3944232e8_derusbi_elex_glassworm_lockbit_wannacry
  • Size 4.8MB
  • Sample260822-pfdl8aeh95
  • SHA256 05816c55ae1f01cfcbcee625d50a3d314f197c16cce758f14292bb8c14014212
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      2026-08-21_78d9192ce754adcd0ee58cd3944232e8_derusbi_elex_glassworm_lockbit_wannacry
    • Size 4.8MB
    • SHA256 05816c55ae1f01cfcbcee625d50a3d314f197c16cce758f14292bb8c14014212
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: Jupyter, SolarMarker

      Jupyter is a backdoor and infostealer first seen in mid 2020.

    • Family: Maze

      Ransomware family also known as ChaCha.

    • Drops file in Drivers directory

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks