Remarks
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
There are no files for this filter
There are no files in this analysis
|
Filename
|
Category
|
Type
|
Severity
|
Actions
|
|
Mime Type
|
application/vnd.microsoft.portable-executable
|
|
File Size
|
239.50 KB
|
|
MD5
|
6a770903d88ffb3446d07eb0dd0f679c
|
|
SHA1
|
ef67768ca63c0a076edd52faf62d4e11a4ca67e1
|
|
SHA256
|
385678267be902deec070929b19b22169f75994c33b6fe1631c657aa305b1ab8
|
|
SSDeep
|
3072:V9RYKOzH4GlWXovYKhGsIspz9qdhi2BBN8vcfEgTDxTHv8FYH:Of4RovthhIs6dhi2nkcMkTP
|
|
ImpHash
|
3fa5d04a221aa111d007d317861959df
|
|
Parser Error Remark
|
Static engine was unable to completely parse the analyzed file
|
|
Severity
|
|
|
First Seen
|
2019-09-13 20:58 (UTC+2)
|
|
Last Seen
|
2019-09-14 01:27 (UTC+2)
|
|
Names
|
Win32.Trojan.Kryptik
|
|
Families
|
Kryptik
|
|
Classification
|
Trojan
|
|
Image Base
|
0x400000
|
|
Entry Point
|
0x40692c
|
|
Size Of Code
|
0x1fa00
|
|
Size Of Initialized Data
|
0x8d4400
|
|
File Type
|
FileType.executable
|
|
Subsystem
|
Subsystem.windows_gui
|
|
Machine Type
|
MachineType.i386
|
|
Compile Timestamp
|
2018-06-19 03:27:56+00:00
|
|
Name
|
Virtual Address
|
Virtual Size
|
Raw Data Size
|
Raw Data Offset
|
Flags
|
Entropy
|
|
.text
|
0x401000
|
0x1f82a
|
0x1fa00
|
0x400
|
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
|
7.22
|
|
.rdata
|
0x421000
|
0x6cca
|
0x6e00
|
0x1fe00
|
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
|
5.74
|
|
.data
|
0x428000
|
0x8bc864
|
0x3800
|
0x26c00
|
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
|
2.15
|
|
.rsrc
|
0xce5000
|
0xa018
|
0xa200
|
0x2a400
|
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
|
4.59
|
|
.reloc
|
0xcf0000
|
0x7748
|
0x7800
|
0x34600
|
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
|
1.76
|
|
API Name
|
Ordinal
|
IAT Address
|
Thunk RVA
|
Thunk Offset
|
Hint
|
|
GetThreadSelectorEntry
|
0x0
|
0x421024
|
0x2738c
|
0x2618c
|
0x290
|
|
GetSystemPowerStatus
|
0x0
|
0x421028
|
0x27390
|
0x26190
|
0x274
|
|
FreeConsole
|
0x0
|
0x42102c
|
0x27394
|
0x26194
|
0x15f
|
|
FindNextVolumeW
|
0x0
|
0x421030
|
0x27398
|
0x26198
|
0x14a
|
|
GetFileAttributesW
|
0x0
|
0x421034
|
0x2739c
|
0x2619c
|
0x1ea
|
|
GetThreadPriorityBoost
|
0x0
|
0x421038
|
0x273a0
|
0x261a0
|
0x28f
|
|
lstrlenW
|
0x0
|
0x42103c
|
0x273a4
|
0x261a4
|
0x54e
|
|
DisconnectNamedPipe
|
0x0
|
0x421040
|
0x273a8
|
0x261a8
|
0xe1
|
|
GetTapeStatus
|
0x0
|
0x421044
|
0x273ac
|
0x261ac
|
0x281
|
|
MoveFileW
|
0x0
|
0x421048
|
0x273b0
|
0x261b0
|
0x363
|
|
GetTickCount
|
0x0
|
0x42104c
|
0x273b4
|
0x261b4
|
0x293
|
|
LocalAlloc
|
0x0
|
0x421050
|
0x273b8
|
0x261b8
|
0x344
|
|
GetNumberFormatW
|
0x0
|
0x421054
|
0x273bc
|
0x261bc
|
0x233
|
|
HeapLock
|
0x0
|
0x421058
|
0x273c0
|
0x261c0
|
0x2d0
|
|
FreeEnvironmentStringsW
|
0x0
|
0x42105c
|
0x273c4
|
0x261c4
|
0x161
|
|
VirtualProtect
|
0x0
|
0x421060
|
0x273c8
|
0x261c8
|
0x4ef
|
|
SetCalendarInfoA
|
0x0
|
0x421064
|
0x273cc
|
0x261cc
|
0x41e
|
|
DeleteTimerQueueTimer
|
0x0
|
0x421068
|
0x273d0
|
0x261d0
|
0xda
|
|
GetFileInformationByHandle
|
0x0
|
0x42106c
|
0x273d4
|
0x261d4
|
0x1ec
|
|
DebugBreak
|
0x0
|
0x421070
|
0x273d8
|
0x261d8
|
0xc7
|
|
CreateDirectoryExA
|
0x0
|
0x421074
|
0x273dc
|
0x261dc
|
0x7d
|
|
SetThreadExecutionState
|
0x0
|
0x421078
|
0x273e0
|
0x261e0
|
0x493
|
|
ClearCommError
|
0x0
|
0x42107c
|
0x273e4
|
0x261e4
|
0x50
|
|
VirtualQuery
|
0x0
|
0x421080
|
0x273e8
|
0x261e8
|
0x4f1
|
|
lstrlenA
|
0x0
|
0x421084
|
0x273ec
|
0x261ec
|
0x54d
|
|
GetPrivateProfileSectionNamesW
|
0x0
|
0x421088
|
0x273f0
|
0x261f0
|
0x23f
|
|
DisableThreadLibraryCalls
|
0x0
|
0x42108c
|
0x273f4
|
0x261f4
|
0xde
|
|
ExitProcess
|
0x0
|
0x421090
|
0x273f8
|
0x261f8
|
0x119
|
|
InterlockedIncrement
|
0x0
|
0x421094
|
0x273fc
|
0x261fc
|
0x2ef
|
|
InterlockedDecrement
|
0x0
|
0x421098
|
0x27400
|
0x26200
|
0x2eb
|
|
EncodePointer
|
0x0
|
0x42109c
|
0x27404
|
0x26204
|
0xea
|
|
DecodePointer
|
0x0
|
0x4210a0
|
0x27408
|
0x26208
|
0xca
|
|
Sleep
|
0x0
|
0x4210a4
|
0x2740c
|
0x2620c
|
0x4b2
|
|
InitializeCriticalSection
|
0x0
|
0x4210a8
|
0x27410
|
0x26210
|
0x2e2
|
|
DeleteCriticalSection
|
0x0
|
0x4210ac
|
0x27414
|
0x26214
|
0xd1
|
|
EnterCriticalSection
|
0x0
|
0x4210b0
|
0x27418
|
0x26218
|
0xee
|
|
LeaveCriticalSection
|
0x0
|
0x4210b4
|
0x2741c
|
0x2621c
|
0x339
|
|
GetLastError
|
0x0
|
0x4210b8
|
0x27420
|
0x26220
|
0x202
|
|
HeapFree
|
0x0
|
0x4210bc
|
0x27424
|
0x26224
|
0x2cf
|
|
GetCommandLineA
|
0x0
|
0x4210c0
|
0x27428
|
0x26228
|
0x186
|
|
HeapSetInformation
|
0x0
|
0x4210c4
|
0x2742c
|
0x2622c
|
0x2d3
|
|
GetStartupInfoW
|
0x0
|
0x4210c8
|
0x27430
|
0x26230
|
0x263
|
|
RaiseException
|
0x0
|
0x4210cc
|
0x27434
|
0x26234
|
0x3b1
|
|
RtlUnwind
|
0x0
|
0x4210d0
|
0x27438
|
0x26238
|
0x418
|
|
HeapAlloc
|
0x0
|
0x4210d4
|
0x2743c
|
0x2623c
|
0x2cb
|
|
WideCharToMultiByte
|
0x0
|
0x4210d8
|
0x27440
|
0x26240
|
0x511
|
|
LCMapStringW
|
0x0
|
0x4210dc
|
0x27444
|
0x26244
|
0x32d
|
|
MultiByteToWideChar
|
0x0
|
0x4210e0
|
0x27448
|
0x26248
|
0x367
|
|
GetCPInfo
|
0x0
|
0x4210e4
|
0x2744c
|
0x2624c
|
0x172
|
|
TerminateProcess
|
0x0
|
0x4210e8
|
0x27450
|
0x26250
|
0x4c0
|
|
GetCurrentProcess
|
0x0
|
0x4210ec
|
0x27454
|
0x26254
|
0x1c0
|
|
UnhandledExceptionFilter
|
0x0
|
0x4210f0
|
0x27458
|
0x26258
|
0x4d3
|
|
SetUnhandledExceptionFilter
|
0x0
|
0x4210f4
|
0x2745c
|
0x2625c
|
0x4a5
|
|
IsDebuggerPresent
|
0x0
|
0x4210f8
|
0x27460
|
0x26260
|
0x300
|
|
IsProcessorFeaturePresent
|
0x0
|
0x4210fc
|
0x27464
|
0x26264
|
0x304
|
|
GetProcAddress
|
0x0
|
0x421100
|
0x27468
|
0x26268
|
0x245
|
|
GetModuleHandleW
|
0x0
|
0x421104
|
0x2746c
|
0x2626c
|
0x218
|
|
SetStdHandle
|
0x0
|
0x421108
|
0x27470
|
0x26270
|
0x487
|
|
InitializeCriticalSectionAndSpinCount
|
0x0
|
0x42110c
|
0x27474
|
0x26274
|
0x2e3
|
|
GetFileType
|
0x0
|
0x421110
|
0x27478
|
0x26278
|
0x1f3
|
|
WriteFile
|
0x0
|
0x421114
|
0x2747c
|
0x2627c
|
0x525
|
|
GetConsoleCP
|
0x0
|
0x421118
|
0x27480
|
0x26280
|
0x19a
|
|
GetConsoleMode
|
0x0
|
0x42111c
|
0x27484
|
0x26284
|
0x1ac
|
|
HeapCreate
|
0x0
|
0x421120
|
0x27488
|
0x26288
|
0x2cd
|
|
SetHandleCount
|
0x0
|
0x421124
|
0x2748c
|
0x2628c
|
0x46f
|
|
GetStdHandle
|
0x0
|
0x421128
|
0x27490
|
0x26290
|
0x264
|
|
SetFilePointer
|
0x0
|
0x42112c
|
0x27494
|
0x26294
|
0x466
|
|
CloseHandle
|
0x0
|
0x421130
|
0x27498
|
0x26298
|
0x52
|
|
GetModuleFileNameW
|
0x0
|
0x421134
|
0x2749c
|
0x2629c
|
0x214
|
|
GetModuleFileNameA
|
0x0
|
0x421138
|
0x274a0
|
0x262a0
|
0x213
|
|
GetEnvironmentStringsW
|
0x0
|
0x42113c
|
0x274a4
|
0x262a4
|
0x1da
|
|
TlsAlloc
|
0x0
|
0x421140
|
0x274a8
|
0x262a8
|
0x4c5
|
|
TlsGetValue
|
0x0
|
0x421144
|
0x274ac
|
0x262ac
|
0x4c7
|
|
TlsSetValue
|
0x0
|
0x421148
|
0x274b0
|
0x262b0
|
0x4c8
|
|
TlsFree
|
0x0
|
0x42114c
|
0x274b4
|
0x262b4
|
0x4c6
|
|
SetLastError
|
0x0
|
0x421150
|
0x274b8
|
0x262b8
|
0x473
|
|
GetCurrentThreadId
|
0x0
|
0x421154
|
0x274bc
|
0x262bc
|
0x1c5
|
|
QueryPerformanceCounter
|
0x0
|
0x421158
|
0x274c0
|
0x262c0
|
0x3a7
|
|
GetCurrentProcessId
|
0x0
|
0x42115c
|
0x274c4
|
0x262c4
|
0x1c1
|
|
GetSystemTimeAsFileTime
|
0x0
|
0x421160
|
0x274c8
|
0x262c8
|
0x279
|
|
GetLocaleInfoW
|
0x0
|
0x421164
|
0x274cc
|
0x262cc
|
0x206
|
|
HeapSize
|
0x0
|
0x421168
|
0x274d0
|
0x262d0
|
0x2d4
|
|
GetACP
|
0x0
|
0x42116c
|
0x274d4
|
0x262d4
|
0x168
|
|
GetOEMCP
|
0x0
|
0x421170
|
0x274d8
|
0x262d8
|
0x237
|
|
IsValidCodePage
|
0x0
|
0x421174
|
0x274dc
|
0x262dc
|
0x30a
|
|
GetUserDefaultLCID
|
0x0
|
0x421178
|
0x274e0
|
0x262e0
|
0x29b
|
|
GetLocaleInfoA
|
0x0
|
0x42117c
|
0x274e4
|
0x262e4
|
0x204
|
|
EnumSystemLocalesA
|
0x0
|
0x421180
|
0x274e8
|
0x262e8
|
0x10d
|
|
IsValidLocale
|
0x0
|
0x421184
|
0x274ec
|
0x262ec
|
0x30c
|
|
GetStringTypeW
|
0x0
|
0x421188
|
0x274f0
|
0x262f0
|
0x269
|
|
HeapReAlloc
|
0x0
|
0x42118c
|
0x274f4
|
0x262f4
|
0x2d2
|
|
LoadLibraryW
|
0x0
|
0x421190
|
0x274f8
|
0x262f8
|
0x33f
|
|
WriteConsoleW
|
0x0
|
0x421194
|
0x274fc
|
0x262fc
|
0x524
|
|
FlushFileBuffers
|
0x0
|
0x421198
|
0x27500
|
0x26300
|
0x157
|
|
ReadFile
|
0x0
|
0x42119c
|
0x27504
|
0x26304
|
0x3c0
|
|
CreateFileW
|
0x0
|
0x4211a0
|
0x27508
|
0x26308
|
0x8f
|
|
API Name
|
Ordinal
|
IAT Address
|
Thunk RVA
|
Thunk Offset
|
Hint
|
|
InitializeSid
|
0x0
|
0x421000
|
0x27368
|
0x26168
|
0x178
|
|
FreeSid
|
0x0
|
0x421004
|
0x2736c
|
0x2616c
|
0x120
|
|
RegDeleteValueW
|
0x0
|
0x421008
|
0x27370
|
0x26170
|
0x248
|
|
EqualSid
|
0x0
|
0x42100c
|
0x27374
|
0x26174
|
0x107
|
|
QueryServiceLockStatusA
|
0x0
|
0x421010
|
0x27378
|
0x26178
|
0x225
|
|
RegRestoreKeyA
|
0x0
|
0x421014
|
0x2737c
|
0x2617c
|
0x273
|
|
OpenSCManagerW
|
0x0
|
0x421018
|
0x27380
|
0x26180
|
0x1f9
|
|
RegSetValueExW
|
0x0
|
0x42101c
|
0x27384
|
0x26184
|
0x27e
|
|
Name
|
Process ID
|
Start VA
|
End VA
|
Dump Reason
|
PE Rebuild
|
Bitness
|
Entry Points
|
AV
|
YARA
|
Actions
|
|
buffer
|
1
|
0x00EC0558
|
0x00EC8A92
|
Marked Executable
|
-
|
32-bit
|
0x00EC0769
|
|
|
|
|
buffer
|
1
|
0x00020000
|
0x0002AFFF
|
First Execution
|
-
|
32-bit
|
0x00020000
|
|
|
|
|
Threat Name
|
Severity
|
|
Gen:Variant.Graftor.646175
|
|
|
Also Known As
|
C:\Boot\BOOTSTAT.DAT[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
64.28 KB
|
|
MD5
|
3eba2c41848173329c64109d1a2b27f0
|
|
SHA1
|
fbd231358bba5ef0aa8b6c74ea6f45e0ab599da0
|
|
SHA256
|
56d5e84cc3cb9133922105085691a3ce5bb4a9322271f8f8783abe4b7b282939
|
|
SSDeep
|
1536:AG+g2EjzhLsFDn6/tSRlVqb/xNdM6fisrCSm4PFlS63exSJeiFVCaX:pO6zKctSRlVyXM6fd2fYLexSNwM
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\BOOTSECT.BAK (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
8.28 KB
|
|
MD5
|
3166306db3db859f222f5e3e3267a671
|
|
SHA1
|
18d8acbcff81dc049e3d72d0ace35c7f400792a7
|
|
SHA256
|
3d527271e3ba7ff8d6629b9e204f03f376d478bbc1553c2b3abff0f5889956d5
|
|
SSDeep
|
192:Xbsynu2r2AE65tsymvaIP150B0odJmj+Vgd7WCkSZSc7GS2cTh05ZB6:oyu3An5tDa50WodJId7Pn6pcT5
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.69 KB
|
|
MD5
|
6a815bca071b3d280d6a4292d83f5871
|
|
SHA1
|
b71ae9f0e1bfe0807b81ef4b602229503a9de6ee
|
|
SHA256
|
1b10d0afe36211db8c23cfb4dcc13d30558c96fd3f1f5a88e728641ed57d1ed3
|
|
SSDeep
|
48:O5Ty93vLT86+NZujKLLmfMIalz7WAj5L1Dmfx:QTWX86+NZPIMIalzjjHmfx
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.80 KB
|
|
MD5
|
c06a9f4d1dacb045d0a40d524d7864c6
|
|
SHA1
|
6de6d30b37f5f53e0724b63a6213c5264343e04e
|
|
SHA256
|
e30d2a6572884ca618b66adbda1e1013435236c6f205535f6eb2a5b6f7f5e6fe
|
|
SSDeep
|
48:qzZ4JyJ00Tl3fSq/myy3jUDebipWUF9lOGBiyUqjh+cmCRdk:6eN4xNmqi0WUrlQeJfk
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.52 KB
|
|
MD5
|
35bfe5a8c158bdef670d024fd599471b
|
|
SHA1
|
2e54d943658e650c43e3a749966d0c2818ada446
|
|
SHA256
|
6a65714bc36965030646051e12faf7110a920a14b16994a1c023412ffab49321
|
|
SSDeep
|
48:S4Bw23sEjBmlgzLrubsNEvayrbnXzwJZba4IFk+kPAOcVg3vcbKvhJVJWX21:1uyjuGrsiyfnjwJ5EPk4OcVg3vj59b
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.11 KB
|
|
MD5
|
48b5d419aee0f9726be3d5984c92c43c
|
|
SHA1
|
a389e2fe5bac493bda0072b21614bf23faf565ac
|
|
SHA256
|
17da236e7923f7929d9b1693c4c7763b01212fd03db1e9ea6a8ee10fbf2f41dd
|
|
SSDeep
|
48:fTCJBdajyET+xz3I96K/8pc3EJrTlKgYuQ:7xmz49n33ETltw
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.85 KB
|
|
MD5
|
5dd81bba735b8e16f6505a7ec4427249
|
|
SHA1
|
0960e04460b8b5a71c590e9d3ef17a717c002b9e
|
|
SHA256
|
d18bd625347fdd21df477b26e83acc81a62a4546d6966e22fc7a0b7e9f1d0849
|
|
SSDeep
|
48:+0TOGt5lv8yn+V2F3WoXR56zyUsKCr04JDQ7f0s888GzcI:ziSUyJthB56zyU4Ywcs888
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.39 MB
|
|
MD5
|
68151e51941df0384788c5608046e352
|
|
SHA1
|
aedd244ff0c2d4dd1ad9d4c1d4f5de02d7bf7cad
|
|
SHA256
|
590c588447622c0941ef3142c215a2e76e6a793c8db48836aadacd928c9ddffe
|
|
SSDeep
|
49152:E18YgX3oIxQBgiTmovH6GxyQ5IZd/FGHO/fUwiXBMDXJrHWhOPHEZDilz:28YgX3oj1movaMyziO/fzWMDXJr+OsZG
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.60 KB
|
|
MD5
|
981396116028260e5e02ebbcbc5de179
|
|
SHA1
|
7e20d7fa76c875ca5012c3d273eb389a24735ece
|
|
SHA256
|
eb4ab506c89d2f736b3707ed6523184d3001f123a3f179dcfba92b03a58630c2
|
|
SSDeep
|
48:P4lK+Lvs2hnSTinlYjNS68+ildlWU6XTdY9/:PG7sOKinlYjs6J+jmS9/
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.69 KB
|
|
MD5
|
d7e115349d07e6ea4246dd2b7b6a2f42
|
|
SHA1
|
24b747eb617d0926fe0e27205c842313ffa520ec
|
|
SHA256
|
6704ecbc7c160501277b623eb64c57f4c2deff05ea86d194f0adf44b7d739ba9
|
|
SSDeep
|
48:MmU2k2Y6sQ+xKhSXGvLN/JQXT+BpijQ2NbC:MmU2k2YzQ0TehBWaB92NbC
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
3.39 KB
|
|
MD5
|
8d4d04a70504f32d774b8c0092198df1
|
|
SHA1
|
c71ad1dc3391624adbe9ed4c726cc7edcada8ac3
|
|
SHA256
|
53730943432834ebd368f07c192c40c8d47f40a097ef878211c3a996555ecfb9
|
|
SSDeep
|
96:7VRglNJ1pL0vwLtaPKgA76tHop29pjKkPtY9kE3wwzE:wl1RsBin6tHM27KCtmwwzE
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
4.38 KB
|
|
MD5
|
a9ee3b5a7bb50d112abfceb70ae1c5f7
|
|
SHA1
|
2015d4149b5d1b573a91729317515a1ca98c024e
|
|
SHA256
|
a433f23346d573dbc8434a662c6a72f77e2d2088b6db3cd32e2b4edf66f6ec98
|
|
SSDeep
|
96:42Fan6TZmxHjiixq/gmqk8sVOTYQ4QjVOrCXtl1UBZw+xMb:pFHlmxGi2q2OcQbT9lYwL
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.39 MB
|
|
MD5
|
e0646b4ccc70d206a6c50441785a658b
|
|
SHA1
|
4954ef4332bcb41ecc991878a5334ff4231bb810
|
|
SHA256
|
a24cf1be4c85323ef8b79aa08266cd219cd036f38ce7f6b80bb16f8820e8924d
|
|
SSDeep
|
49152:fPz4iQutM4JvKmayj9HNQc+QSibbF1bAVkQaM5bPRLxfXMLJafJ+oN8:fllhsmNt3zbZ1+kQaIRFkdafkQ8
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.64 KB
|
|
MD5
|
8acb86beb9fb592f090e660218afbbe8
|
|
SHA1
|
b79c620cb35df62e6dea6beb1e8fc5d904932c33
|
|
SHA256
|
4a8d83985828272ea05c571688e2a5e8cf5564521ab36099c09e953d6bfd8cc5
|
|
SSDeep
|
48:lR+yMfuPmbuIPKyZ1j5LcGEvH1a4Vn1bHq7PDuh824nCxgIRS:v5gutyZ1VLcTc4V1zq7PDKDgIRS
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.71 KB
|
|
MD5
|
3870cea77038d0fdc757b9f8f350fe03
|
|
SHA1
|
9b06b54caf04cfe510497d47c031f4db3def80e2
|
|
SHA256
|
163d7c2e78095de3c6447ce5abb38a58d55210fd8298c1e19e21c96408ac1081
|
|
SSDeep
|
48:uL/kRle55i9OqO/UdbR2YqorvWnf29xrOsTFwTK:8iAcb2YdqnO9x5QK
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.73 MB
|
|
MD5
|
87632fa00641455222b235fada98e614
|
|
SHA1
|
8697c8a0afb8b5dabcb4518879c5bcc054dc7c81
|
|
SHA256
|
3d61430c79cc278d0215886aa9139838515345fd468bf55ac41b6d0d921a9a0c
|
|
SSDeep
|
49152:JntxgWSBE1qr0nu784VWe/ruhZVSle6n3Ii0jn6mOL6R/3ZRCEsczcbfmO+ZeoCu:JmE1qrM884VFKhZ2e63IrZOL6RfZRqcf
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.03 KB
|
|
MD5
|
ce5415573e2d3944d6373cf26496f7fc
|
|
SHA1
|
ca09300ea33b4247037a10e1a836882ed985eb6b
|
|
SHA256
|
139bb2347fd1ce4e759ff2e016283e121aa592b1ac4d52142e77ebed7afdc31f
|
|
SSDeep
|
48:b3HYt4/pbixl5AfHKpguGlF9l1dwk9j2uo1GdMM4d:b3K4/d05AyE79lDwk9to8T4d
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
855.28 KB
|
|
MD5
|
c03f8fdbdf368b88e55693c193e7b890
|
|
SHA1
|
5907fbac71a9faac32fdf97dbf5d41917a2907cb
|
|
SHA256
|
14ec436cd948e24313ae4e2c174832d80f671052863315cb354d4d255d4ff89d
|
|
SSDeep
|
24576:sCN6v7bKLHgUfCfWUHzPXwd8wulxZIsGnErcP5:srv7bKLL0WuzPlw4xZIjErcP5
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.41 MB
|
|
MD5
|
af969e5c0696d17fa83fdcdb6d153370
|
|
SHA1
|
112f819956b5276180409c558c4882ed2b56b129
|
|
SHA256
|
cf3692d80233f6f2c1067ae4008b7c9927a8eb589219426d6d591dc3ece4a4f4
|
|
SSDeep
|
49152:LygquILv7wZ9Y00pzeh5D4Bxw8GM7RGXhuJQncHAooCMLndmmLl:qxoUJAie8nG2YcgooCMhp
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
9.50 MB
|
|
MD5
|
8e1ef7d7e887e13a5bd10b6626c99aba
|
|
SHA1
|
54fc53f67fa886d81bd4e19e3b80cb5f0fc16df4
|
|
SHA256
|
cd91eb4c65c9dc43bf41de185fa492999ab64ad69bacf7384a3496deee7ce2a7
|
|
SSDeep
|
196608:gzoxJw164HpH9lBl/tus7o4L7tZiTnp/jE4U/bxlLRx+P:g+G1H5JhU4L7tZiTnprP0txRsP
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.40 MB
|
|
MD5
|
932c9e3ce3b8538c2ef21845ac9b3671
|
|
SHA1
|
94bd204a87920d89e4211c586a1dde246fcb9e31
|
|
SHA256
|
02867fa4b1710f0166388108c5101369ffe88bbdf3218668d65118cd53fd5e52
|
|
SSDeep
|
49152:Xk58b95Le9+hCfRKPDWELeV8+FDv3QC7Q+vUAgfq03VqX:X995y0DPzLeV8+NfQapPUqkVqX
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.71 KB
|
|
MD5
|
69093bf1946b6b83fa68bae9e10bab1b
|
|
SHA1
|
7de59b1bfb7f32603ced158c4359ef8b6c9ba5a3
|
|
SHA256
|
e61e91e04624901768d5e993844d7d287d847bf66e23099b9b2b9bd134ea8cfe
|
|
SSDeep
|
48:8yUPkHOmhh6GwtfS4xl7vMEiuMKzBfllTmQDEXFV9n:8yUPkOowtfVtMKMKzBflTcjn
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
860.78 KB
|
|
MD5
|
d1c5f51ebb080e95143fe068f43712fa
|
|
SHA1
|
943c5cc5568f2622926c3ff2f688f802f5fd5a6c
|
|
SHA256
|
cb498f4c7ff422ce65e46044e5647d91f7005722edd1c0657028ce805b2783d4
|
|
SSDeep
|
12288:LTh/cxRL5wvMph+nYEkzbp8V50lixRfQ5tDppjt1A054SfUJq3x52fxuj/473h0:L21Oc9Dzbpe0QI5Ppjt1L55p6pIA7e
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
865.28 KB
|
|
MD5
|
9236d7887fd349dc1df43f06a108fa99
|
|
SHA1
|
17fd77c9cd08ed571b9fab6004bdf9d4f3dffcc3
|
|
SHA256
|
62fd4574e25e2da378e0147b10fae048778140a7a0c6dcfbd81fd045a949b193
|
|
SSDeep
|
24576:INQPUfbkMlOBVwvcASG6aCTFKft76doViF:lPUDZQHAROd/F
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
9.55 KB
|
|
MD5
|
0305c7a4545737b3273ed1786aabcfa8
|
|
SHA1
|
5c69f00abf44f76486d7a32f7b95cd43b0c181f7
|
|
SHA256
|
ae947b3001125a663b8a7b94d56ecc96485a07ef4f20d253e19d77e696918080
|
|
SSDeep
|
192:oagGu71sD8cK9U4mWd6wA1GnL0PL6YMHp0C/ACU06qfzZ/7Tv4UNBxWqb:VuFcK2Wd6wA1GHlH1/SAV/7TDWqb
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.47 KB
|
|
MD5
|
bc0ceef67ccee2756eb1121762a6c6a5
|
|
SHA1
|
7814e1e9f5dadaa881d0340cbf5e21cdb075f57e
|
|
SHA256
|
56b680eb47ba3b200de3814965c594ade9badfa4f14f017f59a890b48912bd25
|
|
SSDeep
|
24:d+5auzrZ78XRppw3hNW0VpSNhF78XrOQoEJhpySK6S9cTeCAOtakAUrO0mK:45zrZ7qppw3hxVmjgSWnytOeDmaGP
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.08 KB
|
|
MD5
|
e045450f817e08265a0cb99032968329
|
|
SHA1
|
bc23f477b4911002313ee07a51105578cca3b26f
|
|
SHA256
|
ee03560cc36c9b405fbc0e75f2d31335ea80496effd17c3bbe36bf24447120ed
|
|
SSDeep
|
48:+IHxShh+5GuPLlPSY1bB+ODcafVMLVcKP8+6Dg7sXE:xHxShhcXFBPk3Hs0
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
848.78 KB
|
|
MD5
|
888057be4154ad0731e69467cb029eda
|
|
SHA1
|
f1f71829ac2160db272b32859e51a01003c43fa1
|
|
SHA256
|
be3c7d1c2464636f29c14683fdcd6c801d8465584b5ee9646bcaaec47c7de077
|
|
SSDeep
|
24576:Z5JbX1KaDEfwKZTfnoWDSEipAhD+bVIo/p+Sgut7002w4:Z5hX1nE4KZTflS1pAJ+rv2X
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.63 KB
|
|
MD5
|
176310ab254891d6a9f038e3a8f3ecf4
|
|
SHA1
|
3c371f79b5e4f7c386f46277a6145aede157689e
|
|
SHA256
|
b1ccfae4da3e09c5e1f9d44af342a2b4509d01f39b2e464aab3ee422ccc23214
|
|
SSDeep
|
24:RyiF8vpQoo8lHq1b3egIanV3xDqrZfoasQLTX7U0MiW3Clo8Zo/6161zyqYewDgr:kiF8Tl8bNYjsIX1FWS1Zo/6I1GqYnUao
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
6.38 KB
|
|
MD5
|
182377346a564c902af9e7f4ffffa23c
|
|
SHA1
|
cd66ffd1fdd48c1fbb2d30766c2fa0d0a2cd5fed
|
|
SHA256
|
d6ab7d5d3e372c8b40566f86fb94357b91d94def52c7a127bff6080bea8b3e0d
|
|
SSDeep
|
192:umGIa4lFoqiBOCY7byRsGn3KjhAYrWgbvyzN:CQFoqiBONAsGnDyWgbo
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.58 KB
|
|
MD5
|
5144e53f5cc4321cea3482ee2505ee99
|
|
SHA1
|
a91290b17ac3a1b6f6ab09e17df2d88e515dfdbc
|
|
SHA256
|
3fcb695bcc7e77ac5613ce27ee2650631dfcffa6200d57b05f719a1fff729181
|
|
SSDeep
|
48:QmH1WB6O6bw6Ibkbriu9jg/nxZ31nEtVSxxIb8Z6I7aODHhET3HhylB1qtSr:V1WB6OswHKriu+/xbqTGmODHhe3HXK
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.85 KB
|
|
MD5
|
e2bf6248c72c21b014b4da905fc71313
|
|
SHA1
|
b183c267b121bee91e7737ff4805753326d94383
|
|
SHA256
|
534fcfb5302b9c905c2ef112f1463655f3e75cf7f9b1cf2c2402087669f2ce6a
|
|
SSDeep
|
48:G2rLryL6nHmrB25FvvoTR0P9hyHvgYCA59zQCRaq4:G2XrRnHmrwvwTR0DyPgYCzbq4
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.22 KB
|
|
MD5
|
c9e9afd095b874336b489674abf31d7a
|
|
SHA1
|
0d48d57c50ebc72064f4a0f287a3f41b528c8c90
|
|
SHA256
|
dd899e0a284aabb0b2275f0722357598c45d5e2751502a7050b142db8b2a6e90
|
|
SSDeep
|
48:WODdLEGaAB0nGfLAPStOP+uOYNTaNukwfUe5xADT1DBY5NJuTJqEGp:3ZEBAOqAK8P+WNuukXUxo1DVqnp
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.39 MB
|
|
MD5
|
339d415a53400095bdfa1e424e61bea1
|
|
SHA1
|
8181fe112520d09c251e0231e9a434a17dd471c2
|
|
SHA256
|
657077cc536423132cd8389235c5fd39caa1274a12795a355e739aa251a2934e
|
|
SSDeep
|
49152:KNYk3HIDqCKj8KHX1QnDmp3VNAl7zuNmV8udpZW9MEiG/ggDQuDo1d3/fB:lk5CKjzX1eDCc7i0rHnwxDQuDo1d3B
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
853.78 KB
|
|
MD5
|
5d203e30589e21f23d796e141788d8ed
|
|
SHA1
|
5be16322fb1c57aa9e3ba584a6e5c7eb903166c4
|
|
SHA256
|
8256957dd35b2b98d79bcde28b908c908192c99937ccd31d4eabadba8a037c2f
|
|
SSDeep
|
24576:e2urpQA3YQJggalPrXzTT67k68LnrVmy0wit:QtQAXiPrvt68jr/xit
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.79 MB
|
|
MD5
|
2fab9d2b33df5a80ee6391a5de899d24
|
|
SHA1
|
6928746de612cf79286daf76c51cf36f9b381dc4
|
|
SHA256
|
20704e5f28c19020113a42df82ebac0f0d193337d805fc3a23c858bfb0fd961f
|
|
SSDeep
|
49152:FYVqmQxsy62Gipv0mefiq1AyQCFQoPzg63UjZT9JrtUTQuPp9XqbSc:KglxsyLVv0mNyxQoP0EUtT9JxUUsp9UB
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
6.02 KB
|
|
MD5
|
d97e65a5b7f2e66d5ca2eba1ff53d079
|
|
SHA1
|
780872a0cb2f3a9af19b8aadb9534c2b5c32a5ef
|
|
SHA256
|
f6e4ef96aaf4ead57f9421424c2f51094fe2f9d7b802d48ff613b9c52f950221
|
|
SSDeep
|
96:SGZm3Mbj2MZ4kcF1Jf8onvKNnQMjXTM62g8PGnG56vbd/FPss89RmdHYK6ALXlIT:dNncFHrCNn1TM62KRvbd9PJ89EHwca00
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.40 MB
|
|
MD5
|
e63776e01eb442920cb6f8ee2aedfdda
|
|
SHA1
|
ba7000c0f4bf18b2e02e21e23954bf3b26d5f8b5
|
|
SHA256
|
c9a8f0042f5f6f6222b5fea2330b5c36bb8077bcfac2eeffd0b305899cda7842
|
|
SSDeep
|
49152:llAcZQ1R+5VJO2WUqTyGCVdjhbmwAKj4wJLmjR9/7IP+4AsPsmKmq:FSv+5VQUKy1jgDOB437IP+ismKj
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.06 KB
|
|
MD5
|
2381fac44405b133eaf871143e84a008
|
|
SHA1
|
85ace4994853d51d950e4a15700e9cd0bb1b2a27
|
|
SHA256
|
42f7f048387e9e929e06be0e974b0af81e857a6be339b49cd4e4f52b2abd2245
|
|
SSDeep
|
24:QcdR45iyIQTHxQHvBxInoXm0bqo9Zt5l/Pn1DjxUgwY:QJa4Rgjao9Ztv//LUY
|
|
Rule Name
|
Rule Description
|
Classification
|
Score
|
Actions
|
|
HermesRyukEncryptedFile
|
File encrypted by Hermes or Ryuk Ransomware
|
Ransomware
|
|
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
16.19 MB
|
|
MD5
|
016cbf221886acffda0f56f9d9ccd4d2
|
|
SHA1
|
d39a40b88c171a9b83c486728950ba06dcbc6ef8
|
|
SHA256
|
fbf857eecf7aca7d2da75f9cef7ebc79316f912525abfaaf892eee7aae4dc6a0
|
|
SSDeep
|
196608:EVUbcaoytNMLUEfRrDXP2ifogB+jHcSBLWiyvyWJRMLhdPWfi:Eav29JrL2ifJEjhW/6vL3Ai
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
10.95 MB
|
|
MD5
|
e00cd81a7668f94279198d99c9e1c484
|
|
SHA1
|
ab6c40a317d7d9e4fae2abc430ac6e4ae81714fb
|
|
SHA256
|
0add9468b3eaaaaade99128b2803c0a85aa4e39bc146d56eef46ef02b90ce8ea
|
|
SSDeep
|
196608:IlQBQvb626wEYYIcjfX+vntQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:IlQBQzBxtY5mvJGBZWGRz1kaza0h
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
14.13 MB
|
|
MD5
|
3a9c3807e2a405acae09ecf2f33eef5a
|
|
SHA1
|
d4c08baa901a24be9ffef3d08e7b9528fbfbd188
|
|
SHA256
|
544357b891bb3cb95d0cd00ab7dd68451c8f7dd726107a46027b78da89544000
|
|
SSDeep
|
196608:FK0UaTC0Yz3TRJfUi/zh3E8FclBElWHp8byLbyo9crpLlR8ioLO0ZF9CrpbQ:o0P+Dz/jFgepGHyo2rpLkcoCrpbQ
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
41.78 MB
|
|
MD5
|
bac767fd1abe03dbfbde29a02cd1ab8f
|
|
SHA1
|
31ece3f284b3b407bda0fb8d69d93aa98d151279
|
|
SHA256
|
6fb5547eb8975ca39d02c3fdfcb8340f0233f9a2f24f3c369e662954ba8dd0ae
|
|
SSDeep
|
196608:McELr6hBnsjDjwXSYVqHDKpqzu67P09R6Y9y4DTGXbVsD8uxDxKj:pyrhDue/Q9B9PDTGXezKj
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
67.10 MB
|
|
MD5
|
09cb66d3e732ae7057b35529644922ba
|
|
SHA1
|
81966a5502db6cc1e5afa24755c00538d61216a8
|
|
SHA256
|
1c0568cd20d139db72a8f8faf64a1a268cfbf6ee8039dd720e7b51bae2fc93f5
|
|
SSDeep
|
196608:j261hbChSlOVxkU+pI8rXkGQ/35tUDpVMaA8dEFfS05YDWZfo:/1Mu2cIA0GQPjUDpVMzFxaSg
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab (Modified File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
18.00 MB
|
|
MD5
|
7a2ac777f87a2f3ff454e3c369076518
|
|
SHA1
|
fb04933f33fd74b2b773697e73dc9404c73f3cdf
|
|
SHA256
|
365ad14c0e8d196d584de7893b38b02503d425df7e175937e612e208e3513202
|
|
SSDeep
|
24576:ORI9fQnkQjw40OX4jfjMVbTcdcAowdELfQxs6rZTt:x8kQjw40OX4jSZArqfmsSP
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
20.09 MB
|
|
MD5
|
55b352ea0b19495e742ad3af7581d7f9
|
|
SHA1
|
87cdd60bfd35e2ac2852ba4693e4433ae231411e
|
|
SHA256
|
622aee3ac3864af0bf887d838305e5b33ddf9cc3efe25be3b568b81637361af7
|
|
SSDeep
|
196608:p90DXcrKQzY+w844MFOSQo2eWDOQs4hW6s63HS:pGDgRjyQo2OQ93RS
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
13.01 MB
|
|
MD5
|
70a1428558f1962e781e3bb9baff5039
|
|
SHA1
|
ee2112cf5614abf1291da39e49f7553fdaf5f662
|
|
SHA256
|
db1dc06e1011f57607bb10683f998b1df52514c10ad733992ff6023f8d98e356
|
|
SSDeep
|
196608:O4e7tFkPl+JcvfwHBL4B9lCzT2bOgBoDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:RCt0QJcvfwHNB26gfE7e/7JNMM5RTU+
|
|
Also Known As
|
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab[supportdecrypt@firemail.cc].HRM (Dropped File)
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
16.65 MB
|
|
MD5
|
70991c3a6d89d3ef42ee0502f3af602f
|
|
SHA1
|
219ca032b2029ff73a18f7d575e791e2a802d494
|
|
SHA256
|
79839c5de1d9e9c5e1391c3286fa5fb1f9a62a77e062d67891bc71c444a2abea
|
|
SSDeep
|
196608:1jE2YSy/TTLGR60EvnPzzbqJtq10AM34J+dVGOBJcxPHCXv:y2YSy/TeRAXn4tIS37rzJgk
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
52 bytes
|
|
MD5
|
694f83b3869beefb60b11b186f79c2b3
|
|
SHA1
|
a287bd86d53d0353c947ac1ae65ecfeaf0f464d6
|
|
SHA256
|
81dd9e2ce80e2a8caaaf2c57b06a997a7918c688d4140cf459223cf788c9deec
|
|
SSDeep
|
3:/l62n:/n
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
2.16 KB
|
|
MD5
|
44a266205efa1210fe28baa793386eb6
|
|
SHA1
|
fb7f62286090795710c7b83a4209f50e7acda9dc
|
|
SHA256
|
622a5d4c0d9cd66b27ebac596943b3846c8d57efef294eee1369a80b87b021f8
|
|
SSDeep
|
48:VJK8DfwtbUYbTlsw0zBPfD6LuVMEoJSpwG7Bu6qhOH9qn:VJK8DfwtbzNsnnDJVVQOwwBVQ
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
276 bytes
|
|
MD5
|
765359c2ab0d54a74dd5f3524313edb5
|
|
SHA1
|
6707025956b5aea4855122d2b7d6d535ae695339
|
|
SHA256
|
9dbbf957ac7d4f54d43e5213723d52a9feedfe02803d1f74298c4b22c10243e9
|
|
SSDeep
|
6:mtNhmkKqXtwrYhD0VhVw5xhqgigFohPkIetpFAxAHQtuz:YhftQYOVhVw57BFmcIeJAeHQtk
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
1.41 KB
|
|
MD5
|
5dc9bac207dceed86422c4140b7fb5b3
|
|
SHA1
|
8c5790be5d261a2a942428176cf0117e76a97e72
|
|
SHA256
|
540865fcebb387b6272f1434b13fe5a56cf6de9a315fec268abe7687483d5d28
|
|
SSDeep
|
24:ut1p8dkvSxFK6vbD4FMxcNYvF9mKkxeLYDzgm17SYNN0/0iY2OGtIeulP7IdcO:Oz8iv2XvgZYN9j3R90i/Ib7tO
|
|
Mime Type
|
application/octet-stream
|
|
File Size
|
52 bytes
|
|
MD5
|
93a5aadeec082ffc1bca5aa27af70f52
|
|
SHA1
|
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
|
|
SHA256
|
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
|
|
SSDeep
|
3:/lE7L6N:+L6N
|
|
Also Known As
|
C:\Boot\hu-HU\\DECRYPT_INFORMATION.html (Dropped File)
C:\Config.Msi\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\ja-JP\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\el-GR\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\pt-BR\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\nl-NL\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\fi-FI\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\fr-FR\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\en-US\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\es-ES\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\sv-SE\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\pl-PL\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\da-DK\\DECRYPT_INFORMATION.html (Dropped File)
C:\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\it-IT\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\pt-PT\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\tr-TR\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\zh-CN\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\nb-NO\\DECRYPT_INFORMATION.html (Dropped File)
c:\users\decrypt_information.html (Dropped File)
C:\Boot\zh-HK\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\zh-TW\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\Fonts\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\cs-CZ\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\ru-RU\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
C:\Boot\ko-KR\\DECRYPT_INFORMATION.html (Dropped File)
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\\DECRYPT_INFORMATION.html (Dropped File)
|
|
Mime Type
|
text/html
|
|
File Size
|
6.08 KB
|
|
MD5
|
77cf018d8174ea793657ceef4ecccf02
|
|
SHA1
|
0fc0922f2233042c23c95f3f064497fca78814a7
|
|
SHA256
|
ad8fb0697f922962d6d33ddba5caf2b87796661b131d4beacaa266a787026cfb
|
|
SSDeep
|
96:QS8D6Iu8wfPcYr9VALlFsvf7lV6laIXmggilwj8zBWM+UIevHaErIEbOwcJfBX78:Q4zfBwqtIHzB9+UImRrIEbOJ5hS
|
|
Parser Error Remark
|
Static engine was unable to completely parse the analyzed file
|
|
URL
|
First Seen
|
Categories
|
Threat Names
|
Reputation Status
|
WHOIS Data
|
|
https://www.bestbitcoinexchange.io/
|
-
|
-
|
-
|
|
|
|
https://files.freemusicarchive.org/music%2FOddio_Overplay%2FJohn_Harrison_with_the_Wichita_State_University_Chamber_Players%2FThe_Four_Seasons_Vivaldi%2FJohn_Harrison_with_the_Wichita_State_University_Chamber_Players_-_01_-_Spring_Mvt_1_Allegro.mp3
|
-
|
-
|
-
|
|
|
