ransomware_app[.]zip

resource
unpack001/RansomwareApp.exe

ransomware_app.zip

SHA256 74e901a7e51edf633b47b658d3b687d0fe5d9fca00d430940850c9db65152796
MD5 c916fcfef03557f8a10f4c9c1269808b
SHA1 c328280ee5b2d91a027781e3976dedd7708d3591
SHA512 7b337726740f60962583434a68e2da9bc7d10a3cd95c6c2979b911f65beef321ed14037f7c18b4aa9b51268f463798d0e655a8e8b8f6b0618162f4b3ed538b5f
SSDEEP 96:tucHy1G8RmfvK+d91AoxoLS/XYt13ZCVYO8UuuMYW683+WCd4amh7wVFWBd0:tJHy1G8Ryp/HxoL2ImfgubW6mBVQG0
TLSH
T102D19D005EADE6B7EF28133F68714443210316DDDAEBC2B85490D66AAA6145B9B2A50E
MD5 SHA1 SHA512 SSDEEP TLSH

RUN_DOUBLECLICK.bat

SHA256 154a6f39682085ba5ba747778307589bb384c3e8150b19361d752a8f559b19eb
MD5 cf16cd043c4670840fab723236f9c122
SHA1 14ff03a20b6691bb43c4cbf8d6fd4a322f9336d0
SHA512 fb49c05bb6b652d99a3a55d4bd6464e36acfa289f00c1b70e18ad23d1869e9ec3e2301326b6317565dd929c7605f9b6a7413ccaee4480c80ca4134ce45b73876
TLSH
T102F0AC5E3209732AB95D4E5C295F03C46509B57388FE7D6EE2ED7038208E6562DC9102
MD5 SHA1 SHA512 TLSH

RansomwareApp.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9dd3e0f8422e8c33909854a2e820c9c958dd874c20ff596c587d5c9df71316cc
MD5 60442808b076bcd24e36f7c0ddfbea48
SHA1 3955acadea8c95c91c411e7aa1b1728a7bb5b1ec
SHA512 5089cb9d1af4de6ef219b12f2a6076685d6d625a043360bf542393434d4b53420406d2c9c50577986b8761f4219c7f53055bebeee3c6c02fc95edb8ba0c4356b
SSDEEP 48:6fTfrVui3tsuAJRLxo7jhIBFc6bs7V6jCsXVYOulCcLgDqXSfbNtm:QrVui3tsud79M5HjCsgUcLg9zNt
TLSH
T1FD916601E7E8463BE0FB4B306EF3631263B9FB514977875E2CD842196D2666088627F1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

START_HERE.bat

SHA256 518243480e6f9735e173eceb1000299440568be69b2a203665723e616b342e4e
MD5 5c64d56d7b6ff13b7f531fdce6faf868
SHA1 dab7b067baa5559150cd029101414ca72afd0dff
SHA512 52f0e6c65a2f528b9ae16b37974ccc00ba57d70708c71b4a766e07b0bf0f0e38daee1a82b90b7a695e37cb5609239edb11d3eb89a742e34975a0a4c207e9b609
TLSH
T17D21514E32047335B6295A4DB85B12C1A604A0B741DA2D1EA0FF2138344B5813AFF212
MD5 SHA1 SHA512 TLSH

payload_v2.py

SHA256 ba137b3b87b8b0be50c5e0f26fa60df9e3277701edde11b8fa443e2f66b125c6
MD5 362da3a30e0192b20596eed2143c65e3
SHA1 4150a651871237cb75b2d59ade3ca8d60f74f68a
SHA512 dd66a79217ff8fb6d22091ce1dec2328f799172003492fe627b9bb6c60162eeac8bbbfab86321225c98750bed797c99dab11e284c09d986c2b22eff22cb88003
SSDEEP 192:ZuKjPJlfJ7Qyql3YvzzoEfRhKTX/aPnZ4Ddp28W02s:ZuKDTRLjKePnGB20x
TLSH
T109F1A511DC1B28A1D2F2EA9C9426C4D1F2670313E9228DA7F6ECC7003F7A179D26897D
MD5 SHA1 SHA512 SSDEEP TLSH

ransomware_app.zip

RUN_DOUBLECLICK.bat

RansomwareApp.exe

mscoree

dotnet

START_HERE.bat

payload_v2.py

Sharing

General

Malware Config

Signatures

File Explorer

ransomware_app.zip

RUN_DOUBLECLICK.bat

RansomwareApp.exe

mscoree

dotnet

START_HERE.bat

payload_v2.py