MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 159ac48300931c1c01d8a52d050c96f8c888d774101860fb51889cb4755ddcef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VirLock


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 159ac48300931c1c01d8a52d050c96f8c888d774101860fb51889cb4755ddcef
SHA3-384 hash: a96744273ca14c5694fc71d314fa2d2d36c3e34370ff7b338fca19a84217fe618afbb95496d9d2b724c1a1785100ce3e
SHA1 hash: 3a27b71229600297b457ca9ca6d4da00bed2eab2
MD5 hash: bac49cace1f4cb42199dfc38d03806c0
humanhash: hawaii-early-kentucky-vegan
File name:bac49cac_by_Libranalysis
Download: download sample
Signature VirLock
Create hunting rule
File size:765'440 bytes
First seen:2021-05-05 09:04:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ed39786d62b4f0f662e967d062556c7e (1 x VirLock)
ssdeep 12288:SN3qx4ZQ6Uboqy1o+Dc1FB0ipS3SMiaaTZ5KeyxhlPt9QZTQzmOImcGcXUTB9Tm:Uqy2Fsiz0EAaTOPt9QZTQzphcjwTm
Threatray 101 similar samples on MalwareBazaar
TLSH 95F4BE6FCFF460C0D599D6791B4101D90C52EBAAA8AF5AEFEDAC47B32185FA547B0030
Reporter Libranalysis


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150150/
Detection(s):
Win.Virus.Virlock-6332874-0
Create hunting rule

Win.Virus.Virlock-6804475-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a service
Launching a service
Creating a file in the Windows subdirectories
Creating a file in the %temp% directory
Running batch commands
DNS request
Deleting a recently created file
Sending an HTTP GET request
Launching a process
Creating a process with a hidden window
Searching for the window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/159ac48300931c1c01d8a52d050c96f8c888d774101860fb51889cb4755ddcef/
Threat name:
Win32.Ransomware.VirLock
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 01:06:47 UTC
AV detection:
47 of 48 (97.92%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
30a028001a68cdf37581ab6f3ce9a246ace357589a0f01105f432c09746e317d
VirLock
41e20476662e14ce7e2df3f3755fcbe3cc7c31b7f8a08654eb56333b32272098
VirLock
671fb988c777ad27531f39dd4fb5f4c4483fb7b07e8e493cd72ee8a6572db576
VirLock
89164a030c95d2445557ae7a793a7ab7d849b628fbafb0f483100c580a043a93
VirLock
8926a917f30b552fa4aa51861c526754c8033c286526a2fb95ed7663fbd690ab
VirLock
9073a5af34598caafac313926c120251564fd0f6b87ac327a0acc29fbb34c690
VirLock
baeb7f87041595c27abc2df4fd3cbdea1e21144bcd7d9e2bbc3b6251e4af0370
VirLock
c09e2aa12f24fe3f28ea4ece099700c8015daf728b00dc45d94412c81bd5fe03
VirLock
f5cb4b0567d7d1dd4b6a26aa9e73651108bdc01e76320bd68b56e65551b38457
VirLock
fa126a21c23cf57eb2ebbc8cd9df0a39707dd64a090f0f299416fca5a7fc63fb
VirLock
+ 91 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence ransomware spyware stealer trojan
Link:
https://tria.ge/reports/210505-e3eng3f96e/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies extensions of user files
Modifies WinLogon for persistence
Modifies visibility of file extensions in Explorer
UAC bypass
Unpacked files
SH256 hash:
502418fbfce13dc35fd1776c28fc57402ea05ca5af5f37ef405ee91ed7c9286d
MD5 hash:
cbe7e80d4d856ea1328a215504e351ac
SHA1 hash:
43ae323c4166b3d615b08f30beb7aa45f64bdb6f
Link:
https://www.unpac.me/results/761da21f-9897-464c-8f97-b92ffa7bc25b/
SH256 hash:
4108604d81e72f3d9aa2557cecff2e5c10848d5ea8d5e23c993559aa59f1e16c
MD5 hash:
42f676ff4ba03f61f546663b87a9c265
SHA1 hash:
89cfac032932f355f36f6983fb17e25b3951069c
Link:
https://www.unpac.me/results/761da21f-9897-464c-8f97-b92ffa7bc25b/
SH256 hash:
20610cf0a5304976d97976063e6fe2ad1c0412466e1bc22efc157c5a9d8b0ca1
MD5 hash:
05897079f257eebffb3820e97d60428b
SHA1 hash:
6b8ea1ad02f94a18186ce5e4bc2ce11f1923370a
Link:
https://www.unpac.me/results/761da21f-9897-464c-8f97-b92ffa7bc25b/
SH256 hash:
159ac48300931c1c01d8a52d050c96f8c888d774101860fb51889cb4755ddcef
MD5 hash:
bac49cace1f4cb42199dfc38d03806c0
SHA1 hash:
3a27b71229600297b457ca9ca6d4da00bed2eab2
Link:
https://www.unpac.me/results/761da21f-9897-464c-8f97-b92ffa7bc25b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/159ac48300931c1c01d8a52d050c96f8c888d774101860fb51889cb4755ddcef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150150/

Comments