gibcrypto | 5a3a8229140dd4cea3fcdd2733ba6732fa0d7c28aaf86ff13fc181adf9925ae0

General

Target
zodiac-cipher.html
Size 9KB
Sample260831-2qg4lszena
SHA256 5a3a8229140dd4cea3fcdd2733ba6732fa0d7c28aaf86ff13fc181adf9925ae0
MD5 1266529f4d3740e32cdc93d935f68249
SHA1 dfaf70726e97b4ed8a290bcad7ee8768629361eb
SHA512 463553fff045fa2f8d591044bcf0aa036218f7cf18989551983d991b5d46a6857fc14525c6233e1af172066248d6a09ae42fa68019c4f5b88e436932e7c91e94
SSDEEP 192:QRdSOszUrM9UsVjJ/ddAHF7hPufQMT27sAI/5ZbnzDn/:2SAorU7BgQh7IF/
TLSH
T16322B72676B700607177A96B23D7A78EB184B03BA807F9557ACC96988FC35F5C4F620C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zodiac-cipher.html
- Size 9KB
- SHA256 5a3a8229140dd4cea3fcdd2733ba6732fa0d7c28aaf86ff13fc181adf9925ae0
- MD5 1266529f4d3740e32cdc93d935f68249
- SHA1 dfaf70726e97b4ed8a290bcad7ee8768629361eb
- SHA512 463553fff045fa2f8d591044bcf0aa036218f7cf18989551983d991b5d46a6857fc14525c6233e1af172066248d6a09ae42fa68019c4f5b88e436932e7c91e94
- SSDEEP 192:QRdSOszUrM9UsVjJ/ddAHF7hPufQMT27sAI/5ZbnzDn/:2SAorU7BgQh7IF/
- TLSH
  T16322B72676B700607177A96B23D7A78EB184B03BA807F9557ACC96988FC35F5C4F620C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution gibcrypto impact persistence ransomware trojan upx
- Detects Gibcrypto
- Family: Gibcrypto
  Gibcrypto is a ransomware written in C#.
  ransomware gibcrypto
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1