MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptoLocker


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
SHA3-384 hash: dcdd229f3bafda610a5bf3e46d7147c60dd9a2708606d52730b68faa70209b91fd09db19d6dac20a8f30b98187ce9bba
SHA1 hash: 65559245709fe98052eb284577f1fd61c01ad20d
MD5 hash: 04fb36199787f2e3e2135611a38321eb
humanhash: artist-april-hawaii-chicken
File name:03989399.exe
Download: download sample
Signature CryptoLocker
Create hunting rule
File size:346'112 bytes
First seen:2023-06-09 06:51:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7e8ad4139efc6cbcf31df3bc4b291dd8 (1 x CryptoLocker)
ssdeep 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
TLSH T14F74E073B4919525E9E04DB4F6B9BD324639B8396F3D4BC792842D4E04701CBEAB9383
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
dhash icon 6533b1c3717d4e57 (1 x CryptoLocker)
Reporter Neiki
Tags:Cryptolocker

Intelligence

File Origin
# of uploads :
1
# of downloads :
446
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
chthonic
Create hunting rule
ID:
1
File name:
{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
Verdict:
Malicious activity
Analysis date:
2018-03-06 21:18:11 UTC
Tags:
trojan chthonic
Link:
https://app.any.run/tasks/90871273-7e6d-4664-8126-d62f5bf71100

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/397151/
Detection(s):
Win.Trojan.Cryptolocker-2
Create hunting rule

Win.Trojan.Bublik-365
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
DNS request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
91%
Tags:
crypto cryptolocker filecoder greyware lolbin packed ransomware shell32.dll
Link:
https://www.filescan.io/uploads/6482cc1516ef507f21420096/reports/3abca32e-d58e-464c-86b0-f67be5ee9424/overview
Verdict:
Malicious
Labled as:
Trojan.Blocker
Link:
https://www.hybrid-analysis.com/sample/d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
Malware family:
CryptoLocker
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6e8cbb7b-b3cd-4f96-a01d-5285acb124df
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/375416
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Deletes itself after installation
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries random domain names (often used to prevent blacklisting and sinkholes)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to resolve many domain names, but no domain seems valid
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9/
Threat name:
Win32.Ransomware.Crilock
Create hunting rule
Status:
Malicious
First seen:
2013-09-08 18:46:00 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
36 of 37 (97.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=25s6oixcswljycs4fwipkso3roe2wylzac7ungg3ihd43lmzho4q._file
Verdict:
malicious
Result
Malware family:
cryptolocker
Create hunting rule
Score:
  10/10
Tags:
family:cryptolocker persistence ransomware
Link:
https://tria.ge/reports/230609-hm3flabh8z/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Deletes itself
Executes dropped EXE
Loads dropped DLL
CryptoLocker
Unpacked files
SH256 hash:
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
MD5 hash:
04fb36199787f2e3e2135611a38321eb
SHA1 hash:
65559245709fe98052eb284577f1fd61c01ad20d
Detections:
win_cryptolocker_auto
Create hunting rule
Link:
https://www.unpac.me/results/8199c73c-8499-4851-b146-f58c06a27082/
Malware family:
CryptoLocker
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d765e722e295/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
SNC
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:Win32_Ransomware_CryptoLocker
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects CryptoLocker ransomware.
Rule name:win_cryptolocker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.cryptolocker.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/397151/

Comments