General

  • Target
    2026-09-05_6974ce51559a68c8dbbab912c721f644_derusbi_elex_glassworm_lockbit_wannacry
  • Size 4.9MB
  • Sample260907-xvertsssa1
  • SHA256 d9c171bf94007173dcdb821d7ee36cfa14faf5a2f3689067809de902fde6239b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      2026-09-05_6974ce51559a68c8dbbab912c721f644_derusbi_elex_glassworm_lockbit_wannacry
    • Size 4.9MB
    • SHA256 d9c171bf94007173dcdb821d7ee36cfa14faf5a2f3689067809de902fde6239b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: Jupyter, SolarMarker

      Jupyter is a backdoor and infostealer first seen in mid 2020.

    • Family: Maze

      Ransomware family also known as ChaCha.

    • Drops file in Drivers directory

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks