MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ee51302e53d652b2c2e5683e9810240bdc903b19b2e3b1aae712d123405e4d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VirLock


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ee51302e53d652b2c2e5683e9810240bdc903b19b2e3b1aae712d123405e4d0
SHA3-384 hash: 0729ddf33282258ce5ca38f721355735b4f756f7ad5b27fce4fc95df456489ed20dd01fe1f2768b0fdc4a8b3371d211c
SHA1 hash: 043c55fc32276465d4a74209ad502c0319268ceb
MD5 hash: 8282e30ff7ca3334f3dd6d969a04994d
humanhash: vermont-yellow-gee-uncle
File name:8282e30f_by_Libranalysis
Download: download sample
Signature VirLock
Create hunting rule
File size:768'000 bytes
First seen:2021-05-05 09:02:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 233f2b7e733807a55da1b4fefa43ac68 (1 x VirLock)
ssdeep 12288:NYjHuUirP2V9l1qNqfUybOMiW/b9D4VUKcnAo/j0DxB6zPlWDzr4MlArNTm:NYj7ireV9lU4JiMiWD9D4VU1/j0DxB6I
Threatray 102 similar samples on MalwareBazaar
TLSH 0DF4BFDE145F6829C746077218FC7814728F4AC2E539AC23B597E5F448DB88FE70AA27
Reporter Libranalysis


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150102/
Detection(s):
Win.Virus.Virlock-6332874-0
Create hunting rule

Win.Virus.Virlock-6804475-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a service
Launching a service
DNS request
Sending an HTTP GET request
Searching for the window
Creating a file in the Windows subdirectories
Creating a file in the %temp% directory
Running batch commands
Deleting a recently created file
Launching a process
Creating a process with a hidden window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/711718
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to check if Internet connection is working
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Creates an undocumented autostart registry key
Delayed program exit found
Detected unpacking (overwrites its own PE header)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 404783 Sample: 8282e30f_by_Libranalysis Startdate: 05/05/2021 Architecture: WINDOWS Score: 100 59 Antivirus / Scanner detection for submitted sample 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 Machine Learning detection for sample 2->63 7 8282e30f_by_Libranalysis.exe 3 15 2->7         started        11 HyUMwoYk.exe 4 2->11         started        13 svchost.exe 2->13         started        15 10 other processes 2->15 process3 dnsIp4 47 C:\Users\user\ZKUoAgcQ\ziAwgYQc.exe, PE32 7->47 dropped 49 C:\Users\user\AppData\Local\Temp\cpack.exe, PE32 7->49 dropped 51 C:\ProgramData\UmAcAkEk\lWcEIcQM.exe, PE32 7->51 dropped 53 C:\ProgramDatabehaviorgraphiMAEYkM\HyUMwoYk.exe, PE32 7->53 dropped 81 Creates an undocumented autostart registry key 7->81 83 Uses cmd line tools excessively to alter registry or file data 7->83 85 Tries to detect virtualization through RDTSC time measurements 7->85 87 Delayed program exit found 7->87 18 ziAwgYQc.exe 25 7->18         started        21 lWcEIcQM.exe 7 7->21         started        24 cmd.exe 1 7->24         started        30 3 other processes 7->30 89 Antivirus detection for dropped file 11->89 91 Machine Learning detection for dropped file 11->91 93 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 11->93 95 Changes security center settings (notifications, updates, antivirus, firewall) 13->95 57 127.0.0.1 unknown unknown 15->57 26 lWcEIcQM.exe 15->26         started        28 WerFault.exe 15->28         started        file5 signatures6 process7 dnsIp8 65 Antivirus detection for dropped file 18->65 67 Contains functionality to check if Internet connection is working 18->67 69 Machine Learning detection for dropped file 18->69 77 2 other signatures 18->77 32 explorer.exe 18->32         started        55 192.168.2.1 unknown unknown 21->55 71 Tries to detect virtualization through RDTSC time measurements 21->71 73 Delayed program exit found 21->73 34 cpack.exe 2 24->34         started        37 conhost.exe 24->37         started        39 WerFault.exe 26->39         started        75 Changes the view of files in windows explorer (hidden files and folders) 30->75 41 conhost.exe 30->41         started        43 conhost.exe 30->43         started        45 conhost.exe 30->45         started        signatures9 process10 signatures11 79 Detected unpacking (overwrites its own PE header) 34->79
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ee51302e53d652b2c2e5683e9810240bdc903b19b2e3b1aae712d123405e4d0/
Threat name:
Win32.Ransomware.VirLock
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 09:03:11 UTC
AV detection:
45 of 47 (95.74%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
159ac48300931c1c01d8a52d050c96f8c888d774101860fb51889cb4755ddcef
VirLock
30a028001a68cdf37581ab6f3ce9a246ace357589a0f01105f432c09746e317d
VirLock
41e20476662e14ce7e2df3f3755fcbe3cc7c31b7f8a08654eb56333b32272098
VirLock
4bd8ca7a186343d59945c7258608115dceecb2da70ee94391774ff5f3f6e189f
VirLock
671fb988c777ad27531f39dd4fb5f4c4483fb7b07e8e493cd72ee8a6572db576
VirLock
89164a030c95d2445557ae7a793a7ab7d849b628fbafb0f483100c580a043a93
VirLock
8926a917f30b552fa4aa51861c526754c8033c286526a2fb95ed7663fbd690ab
VirLock
baeb7f87041595c27abc2df4fd3cbdea1e21144bcd7d9e2bbc3b6251e4af0370
VirLock
f5cb4b0567d7d1dd4b6a26aa9e73651108bdc01e76320bd68b56e65551b38457
VirLock
fa126a21c23cf57eb2ebbc8cd9df0a39707dd64a090f0f299416fca5a7fc63fb
VirLock
+ 92 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/210505-y191veyvrn/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies WinLogon for persistence
Modifies visibility of file extensions in Explorer
UAC bypass
Unpacked files
SH256 hash:
b2780f5cc8b4aa720167e8b79acb5b671614eed9687a75e98bb41ae73387451f
MD5 hash:
3d1588a481e9cd4949e1ade2acd43685
SHA1 hash:
7d58ff5c06201f0b98ac06fcd0ca47fbb8692844
Link:
https://www.unpac.me/results/fbcad133-76ef-474b-8e7b-9112fdd55ea3/
SH256 hash:
c240a5778a19680e3458a43257ceb7c6845892c5ee61e40da7d6a1467fe1330c
MD5 hash:
0790c3d83ed041466b959a694c61f55c
SHA1 hash:
cdbe0992d22a6e94d5f3df0b2bbed8729230c747
Link:
https://www.unpac.me/results/fbcad133-76ef-474b-8e7b-9112fdd55ea3/
SH256 hash:
8ee51302e53d652b2c2e5683e9810240bdc903b19b2e3b1aae712d123405e4d0
MD5 hash:
8282e30ff7ca3334f3dd6d969a04994d
SHA1 hash:
043c55fc32276465d4a74209ad502c0319268ceb
Link:
https://www.unpac.me/results/fbcad133-76ef-474b-8e7b-9112fdd55ea3/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150102/

Comments