MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a97731ed4b5723b44f9f6b84f3ae3b213f5d9783ee420a40a336b19c486300d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
VirLock
Vendor detections: 5
| SHA256 hash: | a97731ed4b5723b44f9f6b84f3ae3b213f5d9783ee420a40a336b19c486300d3 |
|---|---|
| SHA3-384 hash: | 711e91454713920686deee44a67be5b42b27ec82fa085245e6b66369669b89100840aa33a7fe40296adda17a660cd093 |
| SHA1 hash: | 063f636947f057c4bd217914336c2aa1e60f648f |
| MD5 hash: | 0a90b2aaf37b9e23e93280d5475b4651 |
| humanhash: | michigan-leopard-mockingbird-equal |
| File name: | 0a90b2aa_by_Libranalysis |
| Download: | download sample |
| Signature | VirLock |
| File size: | 7'376'384 bytes |
| First seen: | 2021-05-05 08:05:57 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fe496da362fd32986f542ed515eaf3c9 (1 x VirLock) |
| ssdeep | 196608:MqIEAdXom3H5DWUjL8Y/6iA/SfeH+hMNlXerKfaHskaHMPeH2fKFUHWvWdYFQLov:UEA93lYpH |
| Threatray | 95 similar samples on MalwareBazaar |
| TLSH | 70769C177A875FEBEE551ACA05990FBB5C25D1A7F83828FA8BF91F3E3056B448C10046 |
| Reporter |  Libranalysis |
Intelligence
File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a file
Creating a process from a recently created file
Creating a service
Launching a service
Creating a file in the Windows subdirectories
DNS request
Creating a file in the %temp% directory
Running batch commands
Deleting a recently created file
Searching for the window
Launching a process
Creating a process with a hidden window
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Ransomware.VirLock
Status:
Malicious
First seen:
2020-05-07 01:17:11 UTC
AV detection:
43 of 48 (89.58%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 85 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
evasion persistence spyware stealer trojan
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies WinLogon for persistence
Modifies visibility of file extensions in Explorer
UAC bypass
Unpacked files
SH256 hash:
d2df51a505bd787f1262e117854ca9013202242ffc035df22af9cf0c129b6ad5
MD5 hash:
d06999ec555017da59c39a68febb2f6e
SHA1 hash:
f7f386ab4bd777eb2c8f11dec36779e14f6a8669
SH256 hash:
1e848ecaf5bb8908e1946415b6ca3a73a1488e3436b9378cd634ddac8f726389
MD5 hash:
da99186a6c048776128a5916c6fdfca7
SHA1 hash:
cfdde5eee8760504d8143ce02d287c21c26b3ca1
SH256 hash:
e2b101923bc070af3a15708a3c69879bd71935c6441cf1019f47e2768ebceaca
MD5 hash:
1eb06ac9316295f514bb05c63900eea3
SHA1 hash:
cf979e1b6d72cb642f3004bafbbe453fe450df5e
SH256 hash:
4eae23e60e21119933e885f14c6af7bffd146169124449ac0dae4163fae9310a
MD5 hash:
24599e1a44d180a90b892f310be34cf0
SHA1 hash:
cbe1160ce1a59117e8a13072ed990c09a2ec3898
SH256 hash:
23fbd1ee66fce6872e97b2fe84c409ab30a74fe8720b722bc6f8bae6e7764c04
MD5 hash:
5ca71cbff5a8de7e5e30b6e94cd42069
SHA1 hash:
991701a32492d743430627cbfbd56d6884c32588
SH256 hash:
8921fe554dcf21ef7a43732853f9dadc79b27bd63ab900e3578768036ba28880
MD5 hash:
dc527f62005d5bac38a7f754d989f930
SHA1 hash:
6fa79cd7e09e614bfececf4115c19c2f2bbff256
SH256 hash:
84ecbad107cfa8012799c66f98d0e20fb3b8fb269d8c5c198a0f76f25e2c7902
MD5 hash:
84727a5600fc38bca121e62b110d9486
SHA1 hash:
2ec9155061e3185bf397276d146704d9f852adac
SH256 hash:
4079acd4abde598ad8bf0e2368eae4bf6de59855480142534079e7087cf4e91c
MD5 hash:
b66f5076f26f85adcc6afabe79d4767b
SHA1 hash:
19c4b73a67fe31d405c61fbcd3104c1aa0b6c527
SH256 hash:
1f32b3c49712a278c385676676b272c758440a6d5969b430bc53c5ed6acff81e
MD5 hash:
26e2c04f68479a4114cfbd9a77fbf22e
SHA1 hash:
0a8f5303c8e1864aa2391a2dd54d48a31a44588b
SH256 hash:
f20b21402aadaae612fdbb47e8db6b35c9fde2c11a7dfe851d2bdae27576bc9b
MD5 hash:
1dc4388f3630beced32b95cfae8ac57d
SHA1 hash:
04949a7e4851f70370bac34c8c6c1434d40e7be8
SH256 hash:
a97731ed4b5723b44f9f6b84f3ae3b213f5d9783ee420a40a336b19c486300d3
MD5 hash:
0a90b2aaf37b9e23e93280d5475b4651
SHA1 hash:
063f636947f057c4bd217914336c2aa1e60f648f
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0030.001] Data Micro-objective::MurmurHash::Non-Cryptographic Hash