MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 659b76788cccfc9c993dd9047e86844c7183957478fabe32455dc2a2ddea49fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VirLock


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 659b76788cccfc9c993dd9047e86844c7183957478fabe32455dc2a2ddea49fb
SHA3-384 hash: 1697f7dd0b80d4da6eee2fb30c0342d415dd7f79d28e8e4b75a671905147ba18b8ea04558cb3c9cd44416a572a4aba1d
SHA1 hash: 5f4e7d99591387bc11ed93a8722aa098696ff0ab
MD5 hash: eca1806e6c6e756c394995baa106baa8
humanhash: spaghetti-floor-butter-yellow
File name:eca1806e_by_Libranalysis
Download: download sample
Signature VirLock
Create hunting rule
File size:639'488 bytes
First seen:2021-05-05 08:03:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c6de4b54f09dafdec2453ca9fe8064ce (1 x VirLock)
ssdeep 12288:gU6d+KFfknyzNh3g2nKNgrNeOd+Ynmz6+L8TIxkqQOnwnKnjTm:ghd5knUD3geqgX6VITbqQOBjTm
Threatray 8 similar samples on MalwareBazaar
TLSH 7CD4AD05A38AA089FF1706323B66C93D6011F296E66207F35970CDED8FDA6472DF6D42
Reporter Libranalysis


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/149967/
Detection(s):
Win.Virus.Virlock-6332874-0
Create hunting rule

Win.Virus.Virlock-6804475-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Sending a UDP request
Creating a process from a recently created file
Creating a service
Launching a service
DNS request
Creating a file in the Windows subdirectories
Sending an HTTP GET request
Searching for the window
Creating a file in the %temp% directory
Running batch commands
Deleting a recently created file
Launching a process
Creating a process with a hidden window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/711627
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Changes the view of files in windows explorer (hidden files and folders)
Creates an undocumented autostart registry key
Delayed program exit found
Detected unpacking (overwrites its own PE header)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 404744 Sample: eca1806e_by_Libranalysis Startdate: 05/05/2021 Architecture: WINDOWS Score: 100 61 Antivirus / Scanner detection for submitted sample 2->61 63 Multi AV Scanner detection for submitted file 2->63 65 Machine Learning detection for sample 2->65 7 eca1806e_by_Libranalysis.exe 3 15 2->7         started        11 vEsQEYIs.exe 4 2->11         started        13 svchost.exe 2->13         started        15 8 other processes 2->15 process3 dnsIp4 49 C:\Users\user\VAkwgYYM\PyggIUcU.exe, PE32 7->49 dropped 51 C:\Users\user\AppData\Local\Temp\cver.exe, PE32 7->51 dropped 53 C:\ProgramData\tcoYQYsk\vEsQEYIs.exe, PE32 7->53 dropped 55 C:\ProgramData\fmoIYAMw\wYQgAsoA.exe, PE32 7->55 dropped 81 Creates an undocumented autostart registry key 7->81 83 Uses cmd line tools excessively to alter registry or file data 7->83 85 Tries to detect virtualization through RDTSC time measurements 7->85 18 PyggIUcU.exe 24 7->18         started        22 wYQgAsoA.exe 2 7->22         started        24 cmd.exe 1 7->24         started        32 3 other processes 7->32 87 Antivirus detection for dropped file 11->87 89 Machine Learning detection for dropped file 11->89 91 Delayed program exit found 11->91 93 Changes security center settings (notifications, updates, antivirus, firewall) 13->93 26 MpCmdRun.exe 13->26         started        59 127.0.0.1 unknown unknown 15->59 28 wYQgAsoA.exe 15->28         started        30 WerFault.exe 15->30         started        file5 signatures6 process7 dnsIp8 57 192.168.2.1 unknown unknown 18->57 67 Antivirus detection for dropped file 18->67 69 Machine Learning detection for dropped file 18->69 71 Injects code into the Windows Explorer (explorer.exe) 18->71 34 explorer.exe 18->34         started        73 Tries to detect virtualization through RDTSC time measurements 22->73 75 Delayed program exit found 22->75 36 cver.exe 2 24->36         started        39 conhost.exe 24->39         started        41 conhost.exe 26->41         started        77 Changes the view of files in windows explorer (hidden files and folders) 32->77 43 conhost.exe 32->43         started        45 conhost.exe 32->45         started        47 conhost.exe 32->47         started        signatures9 process10 signatures11 79 Detected unpacking (overwrites its own PE header) 36->79
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/659b76788cccfc9c993dd9047e86844c7183957478fabe32455dc2a2ddea49fb/
Threat name:
Win32.Ransomware.VirLock
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 08:04:13 UTC
AV detection:
45 of 47 (95.74%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
01b660c91e227a817722d8253374b0e0e535106f116d58c9e7bc74905a6856dd
VirLock
18f98b3e546cd029c9c0a7d3538ee81051feb61ed869b9f9bfc7f2804848c13d
VirLock
3bd7dcf904cb67945b0393b17213877bcec87f8a0ddf2000033ad32a6ac06f8a
VirLock
62acc5d1f03cb597ee923beb74381aa435097f9df0eb0663ee66f6dd40dfaa24
VirLock
728406539dbbb175ad0e0f346d6c9e563c7b95507e91c71af64f220a382525cf
VirLock
90d14abdcdbe7d81729865656ad42613ad7067c85b4cf9c6f850238ca0233c80
VirLock
f4b11885a3056fc56efdedbc0dd71fae152368e4c2e96a3481c6dff21e9d75aa
VirLock
fe0d1bf3cfb9d2c9efa26530095d4541d82b5b80bc73d21d387ca3e37846b5c8
VirLock
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/210505-ck1wfnfy42/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies WinLogon for persistence
Modifies visibility of file extensions in Explorer
UAC bypass
Unpacked files
SH256 hash:
d22278c8b2f72b22fb7367af6dc98472a856334645e6bb3452a244e71d7000ba
MD5 hash:
b99fd2a9ed7d606e27d23c3e7c7b91c7
SHA1 hash:
766e942e3942b42911af167cea93f517ad51aa20
Link:
https://www.unpac.me/results/839d28d5-cb0b-4878-ab40-c6b81d1f792c/
SH256 hash:
1c17bef259a33fbc214b89ffd2a77dc5620ec44891b7e8fb22dbf0cfed197817
MD5 hash:
e405058348cb6ed9d5b4ae4fc63baca6
SHA1 hash:
cd5cdf9a9ea05626b6ba73754cb97e7d26b03806
Link:
https://www.unpac.me/results/839d28d5-cb0b-4878-ab40-c6b81d1f792c/
SH256 hash:
4989229d99709dafe4d8067b69ffa36d3479f52f2f21ebe4215dacc600cd0c03
MD5 hash:
5ace8309e898304ad6f1814ee10f231b
SHA1 hash:
98d3e2b010735f533536756a04d5976282f08ce8
Link:
https://www.unpac.me/results/839d28d5-cb0b-4878-ab40-c6b81d1f792c/
SH256 hash:
659b76788cccfc9c993dd9047e86844c7183957478fabe32455dc2a2ddea49fb
MD5 hash:
eca1806e6c6e756c394995baa106baa8
SHA1 hash:
5f4e7d99591387bc11ed93a8722aa098696ff0ab
Link:
https://www.unpac.me/results/839d28d5-cb0b-4878-ab40-c6b81d1f792c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
VirLock
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/659b76788cccfc9c993dd9047e86844c7183957478fabe32455dc2a2ddea49fb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/149967/

Comments