MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eec416c651bf36aef09c456d4ba9ae03f502bb31cfa2237bf8ea30dbbea053b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VirLock


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eec416c651bf36aef09c456d4ba9ae03f502bb31cfa2237bf8ea30dbbea053b5
SHA3-384 hash: 9ce3a05ebe14597f3d10a02c0daeda618a7e4345dba9b7bffe5e6fb9bf4bbd8d9290787aee0f6e8921b8c58b6cb09415
SHA1 hash: 93967ab0c9e9fc3459e5b3ba3e8396289e872a7a
MD5 hash: 2001c371cc9777a01bd68f6826dda6e4
humanhash: mirror-asparagus-fix-alabama
File name:2001c371_by_Libranalysis
Download: download sample
Signature VirLock
Create hunting rule
File size:764'416 bytes
First seen:2021-05-05 09:07:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 51f277fbcca9ff8e9167d919549378ca (1 x VirLock)
ssdeep 12288:x3SlcEOz27sAtIEuwiJzLvcZUkodYlQ9aN/YDfoXXAf9fDTm:xCCEbqEz+fEtodYlQMNbXXAf97Tm
Threatray 124 similar samples on MalwareBazaar
TLSH F9F4ADE8E9D843D8CD9739B1D02028847AE282D979C4CB35F25C67F10E7B5926C9DD3A
Reporter Libranalysis


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150218/
Detection(s):
Win.Virus.Virlock-6332874-0
Create hunting rule

Win.Virus.Virlock-6804475-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Sending a UDP request
Creating a service
Launching a service
Creating a file in the Windows subdirectories
DNS request
Creating a file in the %temp% directory
Sending an HTTP GET request
Running batch commands
Deleting a recently created file
Launching a process
Creating a process with a hidden window
Searching for the window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/711739
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to check if Internet connection is working
Creates an undocumented autostart registry key
Delayed program exit found
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 404794 Sample: 2001c371_by_Libranalysis Startdate: 05/05/2021 Architecture: WINDOWS Score: 100 63 Antivirus / Scanner detection for submitted sample 2->63 65 Multi AV Scanner detection for submitted file 2->65 67 Machine Learning detection for sample 2->67 8 2001c371_by_Libranalysis.exe 3 15 2->8         started        12 VkcEsAUQ.exe 4 2->12         started        14 svchost.exe 2->14         started        16 9 other processes 2->16 process3 dnsIp4 51 C:\Users\user\paIQAwkQ\fWcUUgIM.exe, PE32 8->51 dropped 53 C:\ProgramData\qicsMAkQ\VkcEsAUQ.exe, PE32 8->53 dropped 55 C:\ProgramData\DEQAIEUA\kCcUkwkc.exe, PE32 8->55 dropped 57 C:\Users\user\AppData\Local\Temp\cver.exe, PE32 8->57 dropped 81 Creates an undocumented autostart registry key 8->81 83 Uses cmd line tools excessively to alter registry or file data 8->83 85 Tries to detect virtualization through RDTSC time measurements 8->85 19 fWcUUgIM.exe 12 8->19         started        23 kCcUkwkc.exe 5 8->23         started        25 reg.exe 1 8->25         started        27 3 other processes 8->27 87 Antivirus detection for dropped file 12->87 89 Machine Learning detection for dropped file 12->89 91 Delayed program exit found 12->91 93 Changes security center settings (notifications, updates, antivirus, firewall) 14->93 59 127.0.0.1 unknown unknown 16->59 file5 signatures6 process7 dnsIp8 61 192.168.2.1 unknown unknown 19->61 69 Antivirus detection for dropped file 19->69 71 Contains functionality to check if Internet connection is working 19->71 73 Machine Learning detection for dropped file 19->73 29 kCcUkwkc.exe 2 19->29         started        31 WerFault.exe 17 9 19->31         started        33 kCcUkwkc.exe 19->33         started        75 Tries to detect virtualization through RDTSC time measurements 23->75 77 Delayed program exit found 23->77 35 WerFault.exe 23 9 23->35         started        79 Changes the view of files in windows explorer (hidden files and folders) 25->79 37 conhost.exe 25->37         started        39 cver.exe 27->39         started        41 conhost.exe 27->41         started        43 conhost.exe 27->43         started        45 conhost.exe 27->45         started        signatures9 process10 process11 47 WerFault.exe 9 29->47         started        49 fWcUUgIM.exe 39->49         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eec416c651bf36aef09c456d4ba9ae03f502bb31cfa2237bf8ea30dbbea053b5/
Threat name:
Win32.Ransomware.VirLock
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 01:10:41 UTC
AV detection:
47 of 48 (97.92%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
2e949fd381c6fe57dd97fa241bbc8c530cbc0e85891074056ff4085f0dbd9484
VirLock
30a028001a68cdf37581ab6f3ce9a246ace357589a0f01105f432c09746e317d
VirLock
41e20476662e14ce7e2df3f3755fcbe3cc7c31b7f8a08654eb56333b32272098
VirLock
671fb988c777ad27531f39dd4fb5f4c4483fb7b07e8e493cd72ee8a6572db576
VirLock
89164a030c95d2445557ae7a793a7ab7d849b628fbafb0f483100c580a043a93
VirLock
8926a917f30b552fa4aa51861c526754c8033c286526a2fb95ed7663fbd690ab
VirLock
8ee51302e53d652b2c2e5683e9810240bdc903b19b2e3b1aae712d123405e4d0
VirLock
baeb7f87041595c27abc2df4fd3cbdea1e21144bcd7d9e2bbc3b6251e4af0370
VirLock
c09e2aa12f24fe3f28ea4ece099700c8015daf728b00dc45d94412c81bd5fe03
VirLock
ffba1f9ea3ffde1803a9fa84158c9768f9b6a2b017a05687457cb0f4680c5cca
VirLock
+ 114 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/210505-hawq4fpqrx/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies WinLogon for persistence
Modifies visibility of file extensions in Explorer
UAC bypass
Unpacked files
SH256 hash:
d22278c8b2f72b22fb7367af6dc98472a856334645e6bb3452a244e71d7000ba
MD5 hash:
b99fd2a9ed7d606e27d23c3e7c7b91c7
SHA1 hash:
766e942e3942b42911af167cea93f517ad51aa20
Link:
https://www.unpac.me/results/ceb4fe05-cdb8-4545-94b2-deadcbfe54e4/
SH256 hash:
1d465a23ce2f67832430e973959259e75b6154cb45595138fc8593f787e89586
MD5 hash:
fd2c9641b60a50ffbd6065f5fbeef3ba
SHA1 hash:
4cd2609bcfd9e033305c2954d0c6659f4884451e
Link:
https://www.unpac.me/results/ceb4fe05-cdb8-4545-94b2-deadcbfe54e4/
SH256 hash:
eec416c651bf36aef09c456d4ba9ae03f502bb31cfa2237bf8ea30dbbea053b5
MD5 hash:
2001c371cc9777a01bd68f6826dda6e4
SHA1 hash:
93967ab0c9e9fc3459e5b3ba3e8396289e872a7a
Link:
https://www.unpac.me/results/ceb4fe05-cdb8-4545-94b2-deadcbfe54e4/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150218/

Comments