Extracted

Extracted

Extracted

• • Target
    http://example.com

  Score

  10^/10

  defense_evasiondiscoveryexecutionexploitcryptodarkrubixhiddentearnetwalkerimpactpersistenceprivilege_escalationransomwareupx

  • Detected Netwalker Ransomware

    Detected unpacked Netwalker executable.

  • Detects CryptoDarkRubix ransomware

  • Detects HiddenTear Ransomware

  • Family: CryptoDarkRubix

    CryptoDarkRubix is a Windows ransomware written in Delphi.

    ransomwarecryptodarkrubix

  • Family: HiddenTear, Cryptear

    HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.

    ransomwarehiddentear

  • Family: Netwalker Ransomware

    Ransomware family with multiple versions. Also known as MailTo.

    ransomwarenetwalker

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (122) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Contacts a large (1298) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Windows Firewall

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence

  • Probable phishing domain

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1