Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Ransomware.zip
  • Size 49.9MB
  • SHA256 72f6748f1c16b750d00541597668e5c306f77759dc998f65f33fe94b8c765b90
  • MD5 03e52009f9429ec5f7bc25aa5f23bff3
  • SHA1 8486848ae4dfeb66626baaa6e7ca37a3c3ba903a
  • SHA512 cfd5427557c16f6a4e80ed713dcf47845c51185647b6de199c83b6ea4d2d6b7144379b553de088e329baf25a5e1818260d019debc6b60e9cf5f6155936a4f397
  • SSDEEP 1572864:gMuxAfc/b2J3BonxImICtWRNkRfG/8LKiHA:+xSsbU3Bo6vCtKkRe/8LLg
  • TLSH
    T150B73325E7272C8CBBDD3F21BB3298E5C3FD344556DF7C0286D348890E9686E8E542A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    Ransomware/$uckyLocker.exe
  • Size 414KB
  • SHA256 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f
  • MD5 c850f942ccf6e45230169cc4bd9eb5c8
  • SHA1 51c647e2b150e781bd1910cac4061a2cee1daf89
  • SHA512 2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9
  • SSDEEP 6144:Av+lDAAB6fm00rx/Qdd1QkfRLT+vLtls6LEmynPsVpw/pcPk19:RdAAB6Mk1HfRLqzPlLEmynPsVpwBT
  • TLSH
    T117946BE0AB45C4A5D8679A79843BDAA37533A24D9C68890D3D92FF0B7D733470023D9B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryhiddentearransomware

  • Detects HiddenTear Ransomware

  • Family: HiddenTear, Cryptear

    HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.

    ransomwarehiddentear

  • Disables Task Manager via registry modification

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral2
• • Target
    Ransomware/7ev3n.exe
  • Size 315KB
  • SHA256 7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5
  • MD5 9f8bc96c96d43ecb69f883388d228754
  • SHA1 61ed25a706afa2f6684bb4d64f69c5fb29d20953
  • SHA512 550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6
  • SSDEEP 6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXv:BswRSslz0P1OdFXJlJ8buXv
  • TLSH
    T183643A54BC8840ADC03693F00AA2C6A5633EF633371569ABBFDD53781E255E1E733A16
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  defense_evasiondiscoveryspywaretrojan
  behavioral3
• • Target
    Ransomware/Annabelle.exe
  • Size 15.9MB
  • SHA256 716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac
  • MD5 0f743287c9911b4b1c726c7c7edcaf7d
  • SHA1 9760579e73095455fcbaddfe1e7e98a2bb28bfe0
  • SHA512 2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677
  • SSDEEP 393216:UMwm0qBknxdEX+LbMUgoSZmWSmh4aaRN22ChHCMNku1y:UMcKX+Lbjgd7W1RNVC9ku1
  • TLSH
    T1E9F633597210F68FC9679A71DA64EEF4E6603C66D30B920791E37DAB7D3C496CE000E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables use of System Restore points

    defense_evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral4
• • Target
    Ransomware/BadRabbit.exe
  • Size 431KB
  • SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
  • MD5 fbbdc39af1139aebba4da004475e8839
  • SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
  • SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
  • SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
  • TLSH
    T1199412426729EE92D1E1B8F84093E7CC4BB97B090FB991EF9D993485CC79B8319380D5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionbadrabbitmimikatzpersistenceransomware

  • Family: BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • mimikatz is an open source tool to dump credentials on Windows

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral5
• • Target
    Ransomware/Birele.exe
  • Size 116KB
  • SHA256 b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23
  • MD5 41789c704a0eecfdd0048b4b4193e752
  • SHA1 fb1e8385691fa3293b7cbfb9b2656cf09f20e722
  • SHA512 76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea
  • SSDEEP 3072:pYV/aVHN9ySTn34w33FVTyuGAxsvBLSqAKZqoqrxy031l3y:8adNlltyu3Pa5gr33
  • TLSH
    T14DC302E9748F8865F1517AF1E7A5ECF4A0BB7E800E4FA74901C0571F2C12B369988AD3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  discoveryupx

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral6
• • Target
    Ransomware/Cerber5.exe
  • Size 313KB
  • SHA256 b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
  • MD5 fe1bc60a95b2c2d77cd5d232296a7fa4
  • SHA1 c07dfdea8da2da5bad036e7c2f5d37582e1cf684
  • SHA512 266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
  • SSDEEP 6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
  • TLSH
    T19F645BC3BAA883CBDD2D43BA12B41F3EBC499E24158F9449D1D4C8D4D98E73278766C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutioncerberpersistenceprivilege_escalationransomware

  • Family: Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Contacts a large (1101) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral7
• • Target
    Ransomware/CoronaVirus.exe
  • Size 1.0MB
  • SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
  • MD5 055d1462f66a350d9886542d4d79bc2b
  • SHA1 f1086d2f667d807dbb1aa362a7a809ea119f2565
  • SHA512 2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
  • SSDEEP 24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2
  • TLSH
    T18F357D22E6A390F1C0652170BD6EB7FF99273C544F1889E7A3D4361C6AB01D10DFBA96
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondharmaimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (868) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral8
• • Target
    Ransomware/CryptoLocker.exe
  • Size 338KB
  • SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
  • MD5 04fb36199787f2e3e2135611a38321eb
  • SHA1 65559245709fe98052eb284577f1fd61c01ad20d
  • SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
  • SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
  • TLSH
    T14F74E073B4919525E9E04DB4F6B9BD324639B8396F3D4BC792842D4E04701CBEAB9383
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverycryptolockerpersistenceransomware

  • Family: CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral9
• • Target
    Ransomware/CryptoWall.exe
  • Size 132KB
  • SHA256 e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734
  • MD5 919034c8efb9678f96b47a20fa6199f2
  • SHA1 747070c74d0400cffeb28fbea17b64297f14cfbd
  • SHA512 745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4
  • SSDEEP 3072:naRQpzd/99wen3XgWorw8I3h8LkMvqCgQfBUnPy8L6kssU:nJdTwo30ri3h8LkMvqCgQfBUPy8L6ksP
  • TLSH
    T1E3D31910D060C3BAE09250F9D7EB0DBDB8355D50235619C763C63F38AB92DE5A731BAA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral10
• • Target
    Ransomware/DeriaLock.exe
  • Size 484KB
  • SHA256 4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
  • MD5 0a7b70efba0aa93d4bc0857b87ac2fcb
  • SHA1 01a6c963b2f5f36ff21a1043587dcf921ae5f5cd
  • SHA512 2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14
  • SSDEEP 6144:lqHKx3YCgy8HmmjJpnVhvLqCO3bLinIz1wASx:lqHoyHNj/nVhvLcyII
  • TLSH
    T1A2B43B3671E1A920DB4A7D31062C911E6664F8FEB5F2B56028C6217BCD5388BC7FA533
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral11
• • Target
    Ransomware/Dharma.exe
  • Size 11.5MB
  • SHA256 6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850
  • MD5 928e37519022745490d1af1ce6f336f7
  • SHA1 b7840242393013f2c4c136ac7407e332be075702
  • SHA512 8040195ab2b2e15c9d5ffa13a47a61c709738d1cf5e2108e848fedf3408e5bad5f2fc5f523f170f6a80cb33a4f5612d3d60dd343d028e55cfc08cd2f6ed2947c
  • SSDEEP 196608:JZnMy97vfgla5NX7YaP6uIEJsp+jb4agYSUpHm6g90MrYmhZZoG0tLzr1+W:LnMy9rfma5NrYaVzC0b4vpZZoG0tR+W
  • TLSH
    T1B6C63313F5905A31D9522A308D79AD34653DBDA14F255E83AB71780D03290FAEBF83E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscoveryexecutionlateral_movementpersistenceprivilege_escalation

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement

  • Modifies Windows Firewall

    defense_evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Modifies visibility of existing users in the login screen

    A user account was hidden or made visible on the Windows login screen through a registry modification.

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Password Policy Discovery

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral12
• • Target
    Ransomware/Fantom.exe
  • Size 261KB
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 7d80230df68ccba871815d68f016c282
  • SHA1 e10874c6108a26ceedfc84f50881824462b5b6b6
  • SHA512 64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
  • SSDEEP 3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
  • TLSH
    T10844D01071C1C2B3C4B7113488E5CB759E7A347247BA95D7B6DD2ABA6E103D1A3362CE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryfantomransomware

  • Family: Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom

  • Renames multiple (60) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  behavioral13
• • Target
    Ransomware/GandCrab.exe
  • Size 291KB
  • SHA256 bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a
  • MD5 e6b43b1028b6000009253344632e69c4
  • SHA1 e536b70e3ffe309f7ae59918da471d7bf4cadd1c
  • SHA512 07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf
  • SSDEEP 6144:nSRCSpUtLz+/enihebWBUOP3yIhLVMmi0CtG7go+I:SUOEnNnHbmP3yIE3tGX
  • TLSH
    T15054DF213AD0C073D113617946A5C7B19E6B74752A66998FBFC80BBD4F287D2EB2430E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral14
• • Target
    Ransomware/GoldenEye/GoldenEye.exe
  • Size 254KB
  • SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
  • MD5 e3b7d39be5e821b59636d0fe7c2944cc
  • SHA1 00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88
  • SHA512 8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5
  • SSDEEP 3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl:i6nrD0ZMcPBAL7c0fTHs+2sYXg
  • TLSH
    T122448B0D7990E92EC4B222719A38E7D2FD3B79314F24919FB7C4695DACE08C19938B17
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdefense_evasiondiscoverymetasploitpersistencetrojan

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral15
• • Target
    Ransomware/InfinityCrypt.exe
  • Size 211KB
  • SHA256 f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
  • MD5 b805db8f6a84475ef76b795b0d1ed6ae
  • SHA1 7711cb4873e58b7adcf2a2b047b090e78d10c75b
  • SHA512 62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416
  • SSDEEP 1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbM:rCVC303p22sZrRQpnviB832Du9WMON
  • TLSH
    T112245E02774ACE78F9A80AB98D62D23C43E57D0357028A2939EB7DCB77333E15A47519
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryinfinitylockransomware

  • Family: InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock
  behavioral16
• • Target
    Ransomware/Krotten.exe
  • Size 53KB
  • SHA256 e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4
  • MD5 87ccd6f4ec0e6b706d65550f90b0e3c7
  • SHA1 213e6624bff6064c016b9cdc15d5365823c01f5f
  • SHA512 a72403d462e2e2e181dbdabfcc02889f001387943571391befed491aaecba830b0869bdd4d82bca137bd4061bbbfb692871b1b4622c4a7d9f16792c60999c990
  • SSDEEP 768:4yKoNLsn4Jp9ZvRInygrpMoZN+WtOl08jxBEHCDwBLpZTPCUvQK:j/sn4/OycxZN+MKxp8t9zQK
  • TLSH
    T17D335A9374A4D0F2C2F163B15D1A3A20EBBDA2663569E7114F647C49AC7B143E7230EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwaredefense_evasiondiscoverypersistencespywarestealer

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence
  behavioral17
• • Target
    Ransomware/Locky.AZ.exe
  • Size 181KB
  • SHA256 2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b
  • MD5 0826df3aaa157edff9c0325f298850c2
  • SHA1 ed35b02fa029f1e724ed65c2de5de6e5c04f7042
  • SHA512 af6c5734fd02b9ad3f202e95f9ff4368cf0dfdaffe0d9a88b781b196a0a3c44eef3d8f7c329ec6e3cbcd3e6ab7c49df7d715489539e631506ca1ae476007a6a6
  • SSDEEP 3072:hVingY1rYkIsBu0qhEEaXIwfBhZ1nJ7lUbKVjcApXH3nX:PigJkrBuAXpZ71nVlUbKtc
  • TLSH
    T14B04E02F66E04137D43A817D7AE9BF7988ADE82C3356182F245955E800331E4EEAC35F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral18
• • Target
    Ransomware/NotPetya.exe
  • Size 390KB
  • SHA256 63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a
  • MD5 5b7e6e352bacc93f7b80bc968b6ea493
  • SHA1 e686139d5ed8528117ba6ca68fe415e4fb02f2be
  • SHA512 9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6
  • SSDEEP 12288:ef/X4NTS/x9jNG+w+9OqFoK323qdQYKU3:EXATS/x9jNg+95vdQa
  • TLSH
    T1B284026131D38172F0F38A3419DAF6674FBEB452877091CECB5A561A2D31781AB383A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionmimikatzpersistencespywarestealer

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • mimikatz is an open source tool to dump credentials on Windows

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral19
• • Target
    Ransomware/PetrWrap
  • Size 473KB
  • SHA256 e079fa28ea51fa98644164caf585ae3231d25372fccca1245902fb57488d4660
  • MD5 17c25c8a7c141195ee887de905f33d7b
  • SHA1 7fa8079e8dca773574d01839efc623d3cd8e6a47
  • SHA512 de95f18101b99d159fe459c5e5651e0db2b1c76e02c9c2741bfd920decc970abc6dc0b41651be0471b4c7c3deb8b5e9a6e956c6515f268f9dfee7b76087a1e2b
  • SSDEEP 12288:ZPaAhutLwUVsvLPcFZXYl0oIZdm9n50DNq:ZPjutLRuvLPcX8mC5S
  • TLSH
    T165A4CF02B6B19071D9A782395679B77A0C39BE2077E4D5F3E7D3285AC8302E1573D386
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral20
• • Target
    Ransomware/Petya.A.exe
  • Size 225KB
  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
  • MD5 af2379cc4d607a45ac44d62135fb7015
  • SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
  • SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
  • SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
  • TLSH
    T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasionpetyapersistenceransomware

  • Detects Petya Ransomware

    ransomware

  • Family: Petya

    Petya is a ransomware written in C#.

    ransomwarepetya

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral21
• • Target
    Ransomware/PolyRansom.exe
  • Size 220KB
  • SHA256 1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423
  • MD5 3ed3fb296a477156bc51aba43d825fc0
  • SHA1 9caa5c658b1a88fee149893d3a00b34a8bb8a1a6
  • SHA512 dc3d6e409cee4d54f48d1a25912243d07e2f800578c8e0e348ce515a047ecf5fa3089b46284e0956bbced345957a000eecdc082e6f3060971759d70a14c1c97e
  • SSDEEP 3072:EJv/3Ppzq+M4Lh5VWK5qlYRV+hvuFiweXXbGgL90v5mq33Z3:8hzEA5GlYMWFBeXvx0c+3
  • TLSH
    T1382429D727B941A2F9113CF0229A82B586470C3EA2D22F14DED83F56667F27DB115A3C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur

  • Modifies visibility of file extensions in Explorer

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Renames multiple (88) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral22
• • Target
    Ransomware/RedBoot.exe
  • Size 1.2MB
  • SHA256 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
  • MD5 e0340f456f76993fc047bc715dfdae6a
  • SHA1 d47f6f7e553c4bc44a2fe88c2054de901390b2d7
  • SHA512 cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc
  • SSDEEP 24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG
  • TLSH
    T103452394A452D017D2C67AB9C036DAB45BA4B831EEC2391BC354F651BD70383CB67B2E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  bootkitdiscoverypersistenceransomwareupx

  • Renames multiple (188) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral23
• • Target
    Ransomware/RedEye.exe
  • Size 10.6MB
  • SHA256 9ac9f207060c28972ede6284137698ce0769e3695c7ad98ab320605d23362305
  • MD5 e9e5596b42f209cc058b55edc2737a80
  • SHA1 f30232697b3f54e58af08421da697262c99ec48b
  • SHA512 e542319beb6f81b493ad80985b5f9c759752887dc3940b77520a3569cd5827de2fcae4c2357b7f9794b382192d4c0b125746df5cf08f206d07b2b473b238d0c7
  • SSDEEP 196608:+ahZ5qN3wvdJBiAv1hXx7jeeDt9/wGoyIu+sTvDmQONhL/LslAVyq8rZyA+TXtT4:+w6NAvPAA/Xx3eeDtTD+GDONhL/AlAV8
  • TLSH
    T144B6330595ABD4C8DF4DA234C7B8DCFA82827C4921AD054B7ACF3C977B7F905E824266
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables use of System Restore points

    defense_evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral24
• • Target
    Ransomware/Rokku.exe
  • Size 666KB
  • SHA256 438888ef36bad1079af79daf152db443b4472c5715a7b3da0ba24cc757c53499
  • MD5 97512f4617019c907cd0f88193039e7c
  • SHA1 24cfa261ee30f697e7d1e2215eee1c21eebf4579
  • SHA512 cfbb8dd91434f917d507cb919aa7e6b16b7b2056d56185f6ad5b6149e05629325cdb3df907f58bb3f634b17a9989bf5b6d6b81f5396a3a556431742ed742ac4a
  • SSDEEP 12288:bB/72HFAQBMiZB7fJJ2qDHKK/K5FJL+xQhrwjeI:bBKqFiT7fJJ2qbKK6F5+xQhrEJ
  • TLSH
    T1D6E4232F4D4C2BEBEB4A58B0B4CB7BD94FE8153A52D85AD18718DB95F5760284340C2F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionimpactransomwareupx

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (82) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral25
• • Target
    Ransomware/Satana.exe
  • Size 49KB
  • SHA256 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
  • MD5 46bfd4f1d581d7c0121d2b19a005d3df
  • SHA1 5b063298bbd1670b4d39e1baef67f854b8dcba9d
  • SHA512 b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
  • SSDEEP 768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
  • TLSH
    T1AC33BF0ADA486E63C971B674EFB7EAFB403C544A5B7D38FB9B84004D053E2F5A163462
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  discovery

  • Suspicious use of SetThreadContext

  behavioral26
• • Target
    Ransomware/Seftad.exe
  • Size 48KB
  • SHA256 2ebe23ba9897d9c127b9c0a737ba63af8d0bcd76ec866610cc0b5de2f62b87bd
  • MD5 86a3a3ce16360e01933d71d0bf1f2c37
  • SHA1 af54089e3601c742d523b507b3a0793c2b6e60be
  • SHA512 65a3571cf5b057d2c3ce101346947679f162018fa5eadf79c5a6af6c0a3bc9b12731ff13f27629b14983ef8bc73fa9782cc0a9e6c44b0ffc2627da754c324d6e
  • SSDEEP 768:WQbWH9cNN5EM4Xk9fFhPc28F3hT/BysVPkzEDGlnwOMYsGfM:v8cbWMFO28FxT3VPkpk
  • TLSH
    T173234A16BBA1C032E062253818B9C2B15B7FBC7352B5859F7B98077D4FB13C0AD69366
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  bootkitdiscoverypersistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral27
• • Target
    Ransomware/SporaRansomware.exe
  • Size 24KB
  • SHA256 7ad9ed23a91643b517e82ad5740d24eca16bcae21cfe1c0da78ee80e0d1d3f02
  • MD5 4a4a6d26e6c8a7df0779b00a42240e7b
  • SHA1 8072bada086040e07fa46ce8c12bf7c453c0e286
  • SHA512 c7a7b15d8dbf8e8f8346a4dab083bb03565050281683820319906da4d23b97b39e88f841b30fc8bd690c179a8a54870238506ca60c0f533d34ac11850cdc1a95
  • SSDEEP 384:akN70EPxIDesCUxvDuzbKGxc5X4LtOFV4U7vqydPNdG2l2Zk1mvlCnqA+PQ+O9G:vZPxIuQunKGxJ44OdPNc2lEfCnqA+PQ+
  • TLSH
    T1ECB2AF5068C2A9F3EDF341745A1AE2027FFF660088759FDB09404A9B7438887F4F9E56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral28
• • Target
    Ransomware/UIWIX.exe
  • Size 211KB
  • SHA256 146581f0b3fbe00026ee3ebe68797b0e57f39d1d8aecc99fdc3290e9cfadc4fc
  • MD5 a933a1a402775cfa94b6bee0963f4b46
  • SHA1 18aa7b02f933c753989ba3d16698a5ee3a4d9420
  • SHA512 d83da3c97ffd78c42f49b7bfb50525e7c964004b4b7d9cba839c0d8bf3a5fe0424be3b3782e33c57debc6b13b5420a3fa096643c8b7376b3accfb1bc4e7d7368
  • SSDEEP 6144:7hsIquZ3xJ7zOUTPQcXK9GMgCsO92FCPot+M:9LquZ3n6cXDM5X2FCgt+M
  • TLSH
    T13D24AE7E57405933C0B88EF5884BB658217AAA302E3E045676D94E19CD77F85BB383CB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral29
• • Target
    Ransomware/ViraLock.exe
  • Size 194KB
  • SHA256 418395efd269bc6534e02c92cb2c568631ada6e54bc55ade4e4a5986605ff786
  • MD5 8803d517ac24b157431d8a462302b400
  • SHA1 b56afcad22e8cda4d0e2a98808b8e8c5a1059d4e
  • SHA512 38fdfe0bc873e546b05a8680335526eec61ccc8cf3f37c60eee0bc83ec54570077f1dc1da26142488930eabcc21cb7a33c1b545a194cbfb4c87e430c4b2bfb50
  • SSDEEP 3072:slkfrcHVaq65Oe/ALwm19MYDzMLGquSOt+nSmgevSvoWAnvN0bfINcfln8rvK:Wkfrc0q47/UwQFSFnH9SArvakSflnCS
  • TLSH
    T142145C99571213AFEE3434BF886523DC5A816F750F068542275A7E2313F62F4A2BC3AC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur

  • Modifies visibility of file extensions in Explorer

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Renames multiple (69) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral30
• • Target
    Ransomware/WinlockerVB6Blacksod.exe
  • Size 2.4MB
  • SHA256 68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c
  • MD5 dbfbf254cfb84d991ac3860105d66fc6
  • SHA1 893110d8c8451565caa591ddfccf92869f96c242
  • SHA512 5e9ccdf52ebdb548c3fa22f22dd584e9a603ca1163a622db5707dbcc5d01e4835879dcfd28cb1589cbb25aed00f352f7a0a0962b1f38b68fc7d6693375e7666d
  • SSDEEP 49152:6kAG2QGTC5xvMdgpdb1KRHGepUu2cGbqPs9+q2HRPTnFVSLE:6kAjQGTCnvMmpYQqPNRPTnF4Y
  • TLSH
    T1A9C5D022B7E3C077E57716B01929E36DD1F9BD609A32808FA3945B1E6B30991D538F23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverypersistence

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral31
• • Target
    Ransomware/satan.exe
  • Size 184KB
  • SHA256 1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7
  • MD5 c9c341eaf04c89933ed28cbc2739d325
  • SHA1 c5b7d47aef3bd33a24293138fcba3a5ff286c2a8
  • SHA512 7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b
  • SSDEEP 3072:H8SIBtQnE7OhssdWJ5jy392aCmCbBq0ryEbh/Wl7hqU6Q4NJ15xgDbvSY5thfRb3:c7qvhssdu5jyYaCmCQVE6hqUI5sb9Rb3
  • TLSH
    T11B04F17CB5005DE9E75E2237DAA5BCBC03B70911E98A58C551D87F8221F33B5FE42A0A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  discovery

  • Suspicious use of SetThreadContext

  behavioral32