MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a97d66d84e2b1415f7d852c645892848cf13b710022c0819fa82823e9cf648a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VirLock


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a97d66d84e2b1415f7d852c645892848cf13b710022c0819fa82823e9cf648a7
SHA3-384 hash: 21229bbf779796e41c84ec4cdc137a10d4159f3ae56bc095d73dbf3f68aa9967582810d1e353799dc874a6169768382c
SHA1 hash: b73122d7e819cf4a38466a8f95df3cc9bec5a9c0
MD5 hash: 7bcd1b422ee2ad9704c08c260ac88833
humanhash: autumn-blossom-fillet-failed
File name:7bcd1b42_by_Libranalysis
Download: download sample
Signature VirLock
Create hunting rule
File size:550'400 bytes
First seen:2021-05-05 08:08:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3c0607c9e02a64670b665f20f91a1c14 (1 x VirLock)
ssdeep 12288:oce8TbTN3jxUDHwxV2Qxy0nLTqPsy17HzdHw1yrY:ZTdVU7wxVn3vqUGBzU
Threatray 54 similar samples on MalwareBazaar
TLSH 1CC4F12028349A75DEDFEF382E0272B9FCA83DB1F1C561BC5943B6D2945D611212E6F8
Reporter Libranalysis


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150061/
Detection(s):
Win.Virus.Virlock-6332874-0
Create hunting rule

Win.Virus.Virlock-6804475-0
Create hunting rule

Win.Trojan.Agent-1368136
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a service
Launching a service
DNS request
Searching for the window
Creating a file in the Windows subdirectories
Creating a file in the %temp% directory
Running batch commands
Deleting a recently created file
Launching a process
Creating a process with a hidden window
Sending an HTTP GET request
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/711685
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes the view of files in windows explorer (hidden files and folders)
Command shell drops VBS files
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Creates an undocumented autostart registry key
Delayed program exit found
Drops batch files with force delete cmd (self deletion)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: WScript or CScript Dropper
Tries to detect virtualization through RDTSC time measurements
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 404767 Sample: 7bcd1b42_by_Libranalysis Startdate: 05/05/2021 Architecture: WINDOWS Score: 100 101 Antivirus / Scanner detection for submitted sample 2->101 103 Multi AV Scanner detection for submitted file 2->103 105 Machine Learning detection for sample 2->105 107 Sigma detected: WScript or CScript Dropper 2->107 11 7bcd1b42_by_Libranalysis.exe 3 16 2->11         started        15 hUoEAggc.exe 4 2->15         started        17 svchost.exe 2->17         started        20 svchost.exe 2->20         started        process3 dnsIp4 85 C:\Users\user\xuwUAgIA\DsYMYUYA.exe, PE32 11->85 dropped 87 C:\ProgramData\rwIwEkUs\YcksccIk.exe, PE32 11->87 dropped 89 C:\ProgramData\JoQAIkcs\hUoEAggc.exe, PE32 11->89 dropped 91 C:\Users\user\AppData\Local\...\SMwwcYoo.bat, ASCII 11->91 dropped 125 Creates an undocumented autostart registry key 11->125 127 Uses cmd line tools excessively to alter registry or file data 11->127 129 Contains functionality to detect hardware virtualization (CPUID execution measurement) 11->129 137 2 other signatures 11->137 22 YcksccIk.exe 14 11->22         started        26 cmd.exe 1 11->26         started        28 DsYMYUYA.exe 16 11->28         started        30 4 other processes 11->30 131 Antivirus detection for dropped file 15->131 133 Machine Learning detection for dropped file 15->133 135 Tries to detect virtualization through RDTSC time measurements 15->135 95 127.0.0.1 unknown unknown 17->95 file5 signatures6 process7 dnsIp8 97 192.168.2.1 unknown unknown 22->97 111 Antivirus detection for dropped file 22->111 113 Machine Learning detection for dropped file 22->113 115 Contains functionality to detect hardware virtualization (CPUID execution measurement) 22->115 33 7bcd1b42_by_Libranalysis.exe 4 26->33         started        37 conhost.exe 26->37         started        117 Tries to detect virtualization through RDTSC time measurements 28->117 119 Delayed program exit found 28->119 93 C:\Users\user\AppData\Local\Temp\file.vbs, ASCII 30->93 dropped 121 Changes the view of files in windows explorer (hidden files and folders) 30->121 39 conhost.exe 30->39         started        41 conhost.exe 30->41         started        43 conhost.exe 30->43         started        45 2 other processes 30->45 file9 signatures10 process11 file12 83 C:\Users\user\AppData\Local\...\LkooMUwA.bat, ASCII 33->83 dropped 109 Uses cmd line tools excessively to alter registry or file data 33->109 47 cmd.exe 1 33->47         started        49 cmd.exe 33->49         started        52 reg.exe 1 33->52         started        54 2 other processes 33->54 signatures13 process14 signatures15 56 7bcd1b42_by_Libranalysis.exe 47->56         started        59 conhost.exe 47->59         started        99 Command shell drops VBS files 49->99 61 conhost.exe 49->61         started        63 cscript.exe 49->63         started        65 conhost.exe 52->65         started        67 conhost.exe 54->67         started        69 conhost.exe 54->69         started        process16 signatures17 123 Uses cmd line tools excessively to alter registry or file data 56->123 71 reg.exe 56->71         started        73 reg.exe 56->73         started        75 reg.exe 56->75         started        process18 process19 77 conhost.exe 71->77         started        79 conhost.exe 73->79         started        81 conhost.exe 75->81         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a97d66d84e2b1415f7d852c645892848cf13b710022c0819fa82823e9cf648a7/
Threat name:
Win32.Ransomware.VirLock
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 08:09:11 UTC
AV detection:
43 of 47 (91.49%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
006a6bed71198de86f59e003a891e431d75e47c3a6ead1b612af6c2f896f6e0b
VirLock
02c295951551d06d573f8631d699d5ce0a1170591fe4e2700754c2bdf8556be7
VirLock
659b76788cccfc9c993dd9047e86844c7183957478fabe32455dc2a2ddea49fb
VirLock
77cad6582c7eff8196fd3c85018d9a2b68fac767337f67d905e7d772bc402b8a
VirLock
ae9b1b8104c668bd930dd7fa999bb9f21bd951862a777a77ec9e3af1cd201c71
VirLock
af774eb13f15ead4f2419305bbfd652dfbb413e957125a944b8247b77a9cf0ef
VirLock
afad289c4180b56d4e597d4304f5928c4ceba337fe3ac08b524246fbb656e46e
VirLock
bb610c8d918c1d4b8e8d9a6d7b6a47b2c0af2364c5462cc5362724773ae4ab9f
VirLock
bc1abcd5c8c6806af001b19a4357bd83444f12c31f9a0fc0b88dc9df6fad7ca2
VirLock
ce110be24e6986a96b43b83b15c1d8d6a20274e47e677fccb47b97c8818a268c
VirLock
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/210505-6bx75kq2cs/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks whether UAC is enabled
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies WinLogon for persistence
Modifies visibility of file extensions in Explorer
UAC bypass
Unpacked files
SH256 hash:
755818b9feef79670638cee1e2c92978d7d16b6027d176b4154d1c36cdef4689
MD5 hash:
90e0c28b6db63dd43c70e72d210bca6c
SHA1 hash:
7fd0f79faea0abf8ca204c37bbb90c9771bff69c
Link:
https://www.unpac.me/results/590b4d74-7e9b-491f-a7bf-2563a71b5e5f/
SH256 hash:
a97d66d84e2b1415f7d852c645892848cf13b710022c0819fa82823e9cf648a7
MD5 hash:
7bcd1b422ee2ad9704c08c260ac88833
SHA1 hash:
b73122d7e819cf4a38466a8f95df3cc9bec5a9c0
Link:
https://www.unpac.me/results/590b4d74-7e9b-491f-a7bf-2563a71b5e5f/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150061/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-05 09:07:04 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0030.001] Data Micro-objective::MurmurHash::Non-Cryptographic Hash