MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34b7745433c223627207c50f435b1fcbdf796206c64a77fe9f28dba094f28d66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VirLock


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34b7745433c223627207c50f435b1fcbdf796206c64a77fe9f28dba094f28d66
SHA3-384 hash: 7aa65fb8eb033491f53deebeee33fb77f2d41aadc67c94aae9e2fe1fa22a6beafbccce419c435c03ca9a092af6a92e8e
SHA1 hash: 6d5f993ffbe02686bb4f3779dc9d6e011e3b55ff
MD5 hash: c83070a1787063f82498abde76d10dbf
humanhash: beer-kitten-sink-failed
File name:c83070a1_by_Libranalysis
Download: download sample
Signature VirLock
Create hunting rule
File size:1'465'344 bytes
First seen:2021-05-05 09:03:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e098bc1cbf523a0f22304d21d265b929 (1 x VirLock)
ssdeep 24576:4EZ1AUj24dPIXtkA6t4I48krSCV6GvKDGSUAE2ZQFF9/k2k/AvRhJ:4EfvjPPItX6y8krHV67iSUIQFTsRwJ
Threatray 110 similar samples on MalwareBazaar
TLSH 0F65F183A38E1F92E897E337C6FADEF0DB94151909030B671D75E0D8018BDA1776A5A3
Reporter Libranalysis


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150112/
Detection(s):
Win.Virus.Virlock-6332874-0
Create hunting rule

Win.Virus.Virlock-6803820-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a service
Launching a service
DNS request
Creating a file in the Windows subdirectories
Sending an HTTP GET request
Creating a file in the %temp% directory
Running batch commands
Deleting a recently created file
Launching a process
Creating a process with a hidden window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34b7745433c223627207c50f435b1fcbdf796206c64a77fe9f28dba094f28d66/
Threat name:
Win32.Ransomware.VirLock
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 15:45:24 UTC
AV detection:
47 of 48 (97.92%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
03252f0d19d2cbf74a06fdc69cd16f80c3329b47400310c70253ff0d31dc1efa
VirLock
38ea0771a9037606de17efe07977a84d86dddee495250b50ffa3fa8879635f85
VirLock
6279abde41ce2445065fd31b0762774da7a532e622d4e144ff47a5b4eda34fc4
VirLock
7b835cb8bff0857c7f074a631cea1042e106dc68cfa0c83f1bac76108b9b5eea
VirLock
92f33d787077d6ebe2fb62adf935c32d86cc39424bb3ec5eb066224c3e9da5e4
VirLock
aa3f8ef2a80b074eabd6b3947b9b61612775890c1963c7d0cc01a60053971a24
VirLock
b920bf0a496b989786853d9513a8453d065eed32a0df24976f30c88976d57505
VirLock
d662eebe16b90f597adeb4a215b05fc65db54078ad55e1d2bd013fda84a64b96
VirLock
f7b7022afea2352c4c4874452f1505e9e4c344923b8b27b661e2b0ccc74f58f6
VirLock
f98af73be4b92fc2ec6ea37223d1c2ee8be6a8e4ee8a449cdd826602b29ec1d9
VirLock
+ 100 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/210505-qhq2b44j5n/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks whether UAC is enabled
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies WinLogon for persistence
Modifies visibility of file extensions in Explorer
UAC bypass
Unpacked files
SH256 hash:
6ebb15b565c96c331e058072fac57a1cee4eace245ac9b0d93679d7430223504
MD5 hash:
b44b8cae8a7e376b8c38e1604457ce0a
SHA1 hash:
e1c3a2812dbaaec16eca532724f98e12a988a77e
Link:
https://www.unpac.me/results/5fb21013-474b-4d5c-a891-86008ca4698e/
SH256 hash:
453b6d7396944f4ef3c3ed4a9f5d62874d05003481fe3c1c40d662f41a439179
MD5 hash:
0233db429dfe15d498c3872f762b9cd6
SHA1 hash:
08a671559b22b9d3e21e46be2120307db23ce1f2
Link:
https://www.unpac.me/results/5fb21013-474b-4d5c-a891-86008ca4698e/
SH256 hash:
8ce71202265da698e8689bcfc0e015e6b75902a64f2b04e51bda9a204dd9e0c0
MD5 hash:
991c203245489f84920b66da3f3b49a1
SHA1 hash:
8f14332512591b1ef7f0cd472b80eadafcdcadb0
Link:
https://www.unpac.me/results/5fb21013-474b-4d5c-a891-86008ca4698e/
SH256 hash:
34b7745433c223627207c50f435b1fcbdf796206c64a77fe9f28dba094f28d66
MD5 hash:
c83070a1787063f82498abde76d10dbf
SHA1 hash:
6d5f993ffbe02686bb4f3779dc9d6e011e3b55ff
Link:
https://www.unpac.me/results/5fb21013-474b-4d5c-a891-86008ca4698e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
VirLock
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/34b7745433c223627207c50f435b1fcbdf796206c64a77fe9f28dba094f28d66

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150112/

Comments