bxbd_ransomware | 12f76f5a56f779ddf702b3e679b36e2275caa7d3de378b2ba413cd4915a828c4

General

Target
plikan.exe
Size 87KB
Sample260909-j31glsdm71
SHA256 12f76f5a56f779ddf702b3e679b36e2275caa7d3de378b2ba413cd4915a828c4
MD5 1f644c2cb1ee22ef05a46367ddeec6d5
SHA1 e1636bb27a7d8819c59497654ea93dbd0af07b50
SHA512 ac6315c35f51924a1784f438e1d8becd9189e17ad27daf2cbe63054b5c66cb51ae30caa07415e5c6f7aad0d7c1b34b8c2177f2f2010e5432cd719a4a3be8c6bb
SSDEEP 1536:drjjxu3AUXzyRbTp43qN0bbObb815rbchA4hR0ZAaXRj/NHOny3qdP7:dLDUmRbt4aKbbO3U5rbchXf0ZAaBrNu9
TLSH
T16B93064073F84927F6FE6EF61D7262400776FAA69D12E39D0CD610DE04A1B94DA60BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  plikan.exe
- Size 87KB
- SHA256 12f76f5a56f779ddf702b3e679b36e2275caa7d3de378b2ba413cd4915a828c4
- MD5 1f644c2cb1ee22ef05a46367ddeec6d5
- SHA1 e1636bb27a7d8819c59497654ea93dbd0af07b50
- SHA512 ac6315c35f51924a1784f438e1d8becd9189e17ad27daf2cbe63054b5c66cb51ae30caa07415e5c6f7aad0d7c1b34b8c2177f2f2010e5432cd719a4a3be8c6bb
- SSDEEP 1536:drjjxu3AUXzyRbTp43qN0bbObb815rbchA4hR0ZAaXRj/NHOny3qdP7:dLDUmRbt4aKbbO3U5rbchXf0ZAaBrNu9
- TLSH
  T16B93064073F84927F6FE6EF61D7262400776FAA69D12E39D0CD610DE04A1B94DA60BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit bxbd_ransomware impact persistence ransomware spyware stealer adware
- Detects BXBD ransomware
- Family: BXBD Ransomware
  BXBD Ransomware is a Windows ransomware written in C#.
  ransomware bxbd_ransomware
- Modifies WinLogon for persistence
  persistence
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2