General
- Target winlocker.exe
- Size 13.6MB
- Sample261107-22rr7af13v
- SHA256 86c68e954c4d755a47306ebb7bf5e6f2d766fec49775e23848c420d4f6635157
- MD5 d35387f9b4a6f233e80552482571c323
- SHA1 860bb8051868eb5e79f3e98697c65f567ec7c359
- SHA512 31a83d7e30c71dd5749543086abfea9b06bf8171d52ef29b928c52d92882161b8dbe86348b3aa9f4979a810bf152ae9bffbbea72fe38e05c4ac4f2ef8325b3b7
- SSDEEP 393216:+zuBU7aW8LoA4v4JuxNZBVSnGCnGjpi2bjRo4Ne8xeElwcAX:NYaW8LrkRrBVSnGCnkpi2nRDeceElwcu
- TLSH T12CE6338876C104D5E59A473888F657B6D3F5BE720764EA8B0BE078621E331E9FD38721
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
winlocker.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
winlocker.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target winlocker.exe
- Size 13.6MB
- SHA256 86c68e954c4d755a47306ebb7bf5e6f2d766fec49775e23848c420d4f6635157
- MD5 d35387f9b4a6f233e80552482571c323
- SHA1 860bb8051868eb5e79f3e98697c65f567ec7c359
- SHA512 31a83d7e30c71dd5749543086abfea9b06bf8171d52ef29b928c52d92882161b8dbe86348b3aa9f4979a810bf152ae9bffbbea72fe38e05c4ac4f2ef8325b3b7
- SSDEEP 393216:+zuBU7aW8LoA4v4JuxNZBVSnGCnGjpi2bjRo4Ne8xeElwcAX:NYaW8LrkRrBVSnGCnkpi2nRDeceElwcu
- TLSH T12CE6338876C104D5E59A473888F657B6D3F5BE720764EA8B0BE078621E331E9FD38721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10Renames multiple (73) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Loads dropped DLL