MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9073a5af34598caafac313926c120251564fd0f6b87ac327a0acc29fbb34c690. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VirLock


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9073a5af34598caafac313926c120251564fd0f6b87ac327a0acc29fbb34c690
SHA3-384 hash: d6afc6aa5e5259a8659e1a7090961d296abdf090db66927d38a87f3f776f0ece96a4afbf73a8b67fb097a757acee42bd
SHA1 hash: 15671797ba7bdc35bd90ce49b13625e85fbc3fca
MD5 hash: 09d0b619c6855f53912167d5cc870c9e
humanhash: ohio-muppet-bluebird-mexico
File name:09d0b619_by_Libranalysis
Download: download sample
Signature VirLock
Create hunting rule
File size:771'072 bytes
First seen:2021-05-05 09:04:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 852e67c73b0c7eed0ea3655789e8e245 (1 x VirLock)
ssdeep 12288:rLgTOCGcfp0Cx40iM0nMazcjjU6awAdpaMPMw8C3IWXbjkmhOY8W3dBTm:A1G60iuz2iwAdpauImbjk0OY8UBTm
Threatray 101 similar samples on MalwareBazaar
TLSH 50F4ADB749262F49D97C443283EE5998D6BFC63AD1D87DB926BF0211E0CC4AEAF31150
Reporter Libranalysis


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150139/
Detection(s):
Win.Virus.Virlock-6332874-0
Create hunting rule

Win.Virus.Virlock-6804475-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Sending a UDP request
Sending a custom TCP request
Creating a process from a recently created file
Creating a service
Launching a service
DNS request
Sending an HTTP GET request
Creating a file in the Windows subdirectories
Creating a file in the %temp% directory
Searching for the window
Running batch commands
Deleting a recently created file
Launching a process
Creating a process with a hidden window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9073a5af34598caafac313926c120251564fd0f6b87ac327a0acc29fbb34c690/
Threat name:
Win32.Ransomware.VirLock
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 00:55:22 UTC
AV detection:
47 of 48 (97.92%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
41e20476662e14ce7e2df3f3755fcbe3cc7c31b7f8a08654eb56333b32272098
VirLock
728406539dbbb175ad0e0f346d6c9e563c7b95507e91c71af64f220a382525cf
VirLock
751f8b351081ff6b1d7134e75dd93daee4e3bb2df6c4049c8a7175bcaa899528
VirLock
7b835cb8bff0857c7f074a631cea1042e106dc68cfa0c83f1bac76108b9b5eea
VirLock
8a139fcd70cf23b397ef1bb31a6b8a5990bd2018bd7e42da6db865a52d49549d
VirLock
904c908a4fbde1b76cc9466543fa36b18fc861efaafc315a1481634feb2ccff8
VirLock
baeb7f87041595c27abc2df4fd3cbdea1e21144bcd7d9e2bbc3b6251e4af0370
VirLock
bb4eb5910eeb9ca18d361175e455427f05ce3017c9724a03dd1d0a757a0b588f
VirLock
f98af73be4b92fc2ec6ea37223d1c2ee8be6a8e4ee8a449cdd826602b29ec1d9
VirLock
fe0d1bf3cfb9d2c9efa26530095d4541d82b5b80bc73d21d387ca3e37846b5c8
VirLock
+ 91 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/210505-j9wjja8mxa/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies WinLogon for persistence
Modifies visibility of file extensions in Explorer
UAC bypass
Unpacked files
SH256 hash:
502418fbfce13dc35fd1776c28fc57402ea05ca5af5f37ef405ee91ed7c9286d
MD5 hash:
cbe7e80d4d856ea1328a215504e351ac
SHA1 hash:
43ae323c4166b3d615b08f30beb7aa45f64bdb6f
Link:
https://www.unpac.me/results/3cd143cf-7901-4f84-bd50-4218b6efa44c/
SH256 hash:
295c9000fbdf727cca47037199671c0b4541d8b5510d8c4e13ce78c0fa1ff6fd
MD5 hash:
1e5387bab48c3a159b007c2f74b0bb04
SHA1 hash:
f94e012aad9378ebc8a03d12fb80611bff055202
Link:
https://www.unpac.me/results/3cd143cf-7901-4f84-bd50-4218b6efa44c/
SH256 hash:
266d2d6f903ceb47916fdcb576e54ba254e10ac123da35b8f6095bd5cc469856
MD5 hash:
d8573faba6d2bc54e820ded1ba4897c8
SHA1 hash:
8ee5340c7e0b9d50bcdbdab08cbf5a9c412ba326
Link:
https://www.unpac.me/results/3cd143cf-7901-4f84-bd50-4218b6efa44c/
SH256 hash:
9073a5af34598caafac313926c120251564fd0f6b87ac327a0acc29fbb34c690
MD5 hash:
09d0b619c6855f53912167d5cc870c9e
SHA1 hash:
15671797ba7bdc35bd90ce49b13625e85fbc3fca
Link:
https://www.unpac.me/results/3cd143cf-7901-4f84-bd50-4218b6efa44c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
VirLock
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9073a5af34598caafac313926c120251564fd0f6b87ac327a0acc29fbb34c690

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150139/

Comments