045a4422f12fe0dd4b1e2f6ac0859a818727c2836d2f0235086a129e48c5a271

Sharing

Copy URL Twitter E-mail

General

Target
UXLocker Builder.zip
Size 824KB
Sample260908-wctycsfp4t
SHA256 045a4422f12fe0dd4b1e2f6ac0859a818727c2836d2f0235086a129e48c5a271
MD5 a764f863ce4fa80713242b99d911a498
SHA1 b86fc6748e87bc8666a14b18e2e83d175a4da655
SHA512 c760c038a92873ba1690e7507e916fddca0570866e93b11ac2fd33a873f8ffa1afd24da3dbdcc898e080aa821d143b1bfa28771fdc505b6bbba0a5510d8785fd
SSDEEP 12288:ycAAIPhciMQUYmhlmzGZcJWIFvpJ8SUibQfGtwCCC5+8jSRlglnbS/hDp7D7XW6C:yXZMQUFlXUvH8SEWVCVp4SJuxx
TLSH
T14605333BA8447922FD624A65ECEC4AF38CC6DF0F82CA9527DA01854D6067B11CD4BFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  UXLocker Builder.zip
- Size 824KB
- SHA256 045a4422f12fe0dd4b1e2f6ac0859a818727c2836d2f0235086a129e48c5a271
- MD5 a764f863ce4fa80713242b99d911a498
- SHA1 b86fc6748e87bc8666a14b18e2e83d175a4da655
- SHA512 c760c038a92873ba1690e7507e916fddca0570866e93b11ac2fd33a873f8ffa1afd24da3dbdcc898e080aa821d143b1bfa28771fdc505b6bbba0a5510d8785fd
- SSDEEP 12288:ycAAIPhciMQUYmhlmzGZcJWIFvpJ8SUibQfGtwCCC5+8jSRlglnbS/hDp7D7XW6C:yXZMQUFlXUvH8SEWVCVp4SJuxx
- TLSH
  T14605333BA8447922FD624A65ECEC4AF38CC6DF0F82CA9527DA01854D6067B11CD4BFD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Locker/LockerBuilder.exe
- Size 18KB
- SHA256 27d65185cf27e2085909ef73411e66888b864be7e32b2afab4506de677dcb614
- MD5 d756b6331d0f00c1fa86bfaddbab180e
- SHA1 fa5a1f2fb437d8c0dc45ca462df711dd78e3f774
- SHA512 38624d9f1b0df6de25714a6500985bfc705ffa87eb695cedcd9082642d91408368b26d5e15ebe9c29f80e3d02df0053f6075d2a2e2012ce9fab64a541fecbdfd
- SSDEEP 384:8z+S+UByAqwBg/MpUg+q7JPwyeE7T5oHvXqxVsiJ:8z+h2W+oHvHS
- TLSH
  T12B82F80AAA7CC7AAD4B4D7F42DB2188103F277261242DA5E6ECB24CE59777640B01753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Locker/LockerBuilder.exe.config
- Size 176B
- SHA256 ad8267122c40d37dcd9d99e1412d763187a1825732f378db8867f3ecf675cf70
- MD5 21fa0b1d75c0cc7369f1e735fe90c7a9
- SHA1 e2d01a1b6aa66e5d3ed575aca79560b014bbfefe
- SHA512 60f6704cd1b3035a1a3403ee3870c7cbc13d6e601172745336ebbffa2ee3dc21785702470ab006c69dbbde0d5525625bb25ade5c641c80c8165fbc46fdad2ad0
- TLSH
  T1D8C080154098BD274D334F176351C525EBB072526464040CF42F9657073104D4247326
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  Locker/LockerBuilder.pdb
- Size 5KB
- SHA256 eb64c7bebe3082bb715758b8afb73f80fe9eed7716ec4e77683f19dde95703e4
- MD5 f0932050f215619e31a3b5be50c266e1
- SHA1 37e39bdbfe38f3e7a754bf71d2d60f8cb96987e1
- SHA512 0057a26f12ab4a6c2677239bbd532e2e69308931b0c4a89b744c47fa4ef0c324c55b4032999b2ffb990c30097dd9140156a1e63229fa7b2820a50cebb88255e0
- SSDEEP 96:g8zVmB5JM+7gvBZjhPkDvCEMXLCMxUZVHEiRpNrf2IVJxme:/O5JM+7uthPkDvOXLCt/7z2Ioe
- TLSH
  T145B1D81BF3105915DE4325756436634AD370D0B9E2049FE5A3C45B6CEDC53CBAEB22AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Locker/MetroFramework.dll
- Size 149KB
- SHA256 baf326f52d39155d722465947f4cc67e6e90cfd0f89954eab959568e9bc342aa
- MD5 44538b311e9ec2bcf0a6452702628d99
- SHA1 da67301539903775708e9ec913654851e9e8eade
- SHA512 b65e3bc1c0f7b4c8f778cf52a36d628301d60aab53fdaf0355163e4865bc3d3adbf8870bb6cefc604708fdf2c0e72258eaf2fe301d524af2f77bc08014c9610a
- SSDEEP 3072:LU0T+erz8jYxYg5lzrPHlMUzxXd4kRZPI9q:vT+erz8jYxYgv/lxXGWPS
- TLSH
  T139E33B21770D457FC6BF4A7AF0A12492C3B0DC51FA7BDF5D5C82A29C989B794AE01283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Locker/Sounder/sound.wav
- Size 407KB
- SHA256 316dcdf28cc545bc32554b2d93d7505b3a6c570fb8b93cb172876ec65e250c27
- MD5 df5ddac16cfca4dc22db3e3d756cc595
- SHA1 615d29a354de284d65f439d328c50c82e8dd7a91
- SHA512 de251c5a7e4efb4a429db7da469ed167dafe644cd39c40f1881b79b4ce7be9f9ca395f3765bf5cb3d120e62aabc888e38b1880adb28f51581e2b7142856859ca
- SSDEEP 768:6diCI3RoVMwMHvR2g2w4KKOsgsl832uEA/LTOfs9G9BkC7yTAg9akcTLV4vos7ND:ZTAg91WeousY53DlpqoWVys86ZRD9
- TLSH
  T1E994C0957782FC01C416B4BE558ED6E95737BF844B05A22374A2B7BF2F68A400CCE6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Locker/Stub/Stub.exe
- Size 215KB
- SHA256 19b6c1905f4435815f6d79b7eb0aee50ccc6d4ccde4dca9b973e3589e15fc00d
- MD5 f92e29949ab567932169f73da6291cca
- SHA1 1b44771253389ab095ef5a356245e743d627a0c6
- SHA512 c57eed984bd716de5f2889c68b776e11673b57f7f03513b40e3285ae5f3fc487ad4f672e99b7539bb514448643d2a07f7e40693d1b9401b8345f84f05539f891
- SSDEEP 3072:XJLxqB76ZepgiHpOGYGKk7YC/mxvWvbXa9XNExSCpMW90KImQijndBbY6cSeq2nV:px5GXuXcSCpMW90KImQijnfb6nRtjU
- TLSH
  T183245BD826964D7AC87E53BE9191214603F8E016D603E78CEBE9B4F47D63B21CB05B4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware discovery persistence privilege_escalation ransomware spyware
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  Locker/dnlib.dll
- Size 1.1MB
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH
  T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Locker/dnlib.xml
- Size 1.8MB
- SHA256 2c4e2806188d354cbf7bf81bbc3963eb465d10dcbac8a75690b219886d164416
- MD5 d5bc999b9d5cbc01e803f406952c21ff
- SHA1 645a318570c531c5470b3e114b53d74f21d783aa
- SHA512 5245c5e5e098ae915209c97a41724fbc9c849e2ec339f3517190edf4556660534a081c249b57ad145c164526c59b381a1cc69b7a95a0b529acf2d3c03c9713f7
- SSDEEP 6144:VTA+HpSCIPAqPFgrOLkOXhR+y+cNUaOtCW5n:dpSCIPAqPFgrO7XhR+y+cNUaOtCW5n
- TLSH
  T150857714B6C2AD121C36525B9E64FCC4FE550C33604A2E19B68D2F535F7ADCBE2AF920
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18