General
- Target https://github.com/kh4sh3i/Ransomware-Samples/tree/main
- Sample261017-xtz2dayshy
Score
10/10
Malware Config
Targets
-
- Target https://github.com/kh4sh3i/Ransomware-Samples/tree/main
Score10/10-
Family: Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Executes dropped EXE
-
Checks for any installed AV software in registry
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
MITRE ATT&CK Enterprise v16
Defense Evasion
Indicator Removal
1File Deletion
1Masquerading
1Match Legitimate Name or Location
1Discovery
Browser Information Discovery
1Query Registry
2Software Discovery
1Security Software Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1