11.3.sfrvjvv.5c0000.0.raw.unpack | JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | |
11.2.sfrvjvv.400000.0.unpack | JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | |
18.0.253.exe.400000.0.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
15.2.959.exe.7701b0.1.raw.unpack | JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | |
11.2.sfrvjvv.5a0e67.1.raw.unpack | JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | |
0.3.file.exe.5f0000.0.raw.unpack | JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | |
15.2.959.exe.7701b0.1.unpack | JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | |
18.0.253.exe.400000.3.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
0.2.file.exe.5e0e67.1.raw.unpack | JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | |
18.2.253.exe.400000.0.raw.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe23ea:$s1: http://
- 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe23ea:$f1: http://
|
18.2.253.exe.400000.0.raw.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.2.253.exe.400000.0.raw.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xffe88:$x1: C:\SystemID\PersonalID.txt
- 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0x1002ec:$s1: " --AutoStart
- 0x100300:$s1: " --AutoStart
- 0x103f48:$s2: --ForNetRes
- 0x103f10:$s3: --Admin
- 0x104390:$s4: %username%
- 0x1044b4:$s5: ?pid=
- 0x1044c0:$s6: &first=true
- 0x1044d8:$s6: &first=false
- 0x1003f4:$s7: delself.bat
- 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.2.253.exe.400000.0.raw.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.5.raw.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
0.2.file.exe.400000.0.unpack | JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | |
18.0.253.exe.400000.7.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe0dea:$s1: http://
- 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe0dea:$f1: http://
|
18.0.253.exe.400000.7.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.7.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfe888:$x1: C:\SystemID\PersonalID.txt
- 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfecec:$s1: " --AutoStart
- 0xfed00:$s1: " --AutoStart
- 0x102948:$s2: --ForNetRes
- 0x102910:$s3: --Admin
- 0x102d90:$s4: %username%
- 0x102eb4:$s5: ?pid=
- 0x102ec0:$s6: &first=true
- 0x102ed8:$s6: &first=false
- 0xfedf4:$s7: delself.bat
- 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.7.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.2.253.exe.400000.0.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe0dea:$s1: http://
- 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe0dea:$f1: http://
|
18.2.253.exe.400000.0.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.2.253.exe.400000.0.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfe888:$x1: C:\SystemID\PersonalID.txt
- 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfecec:$s1: " --AutoStart
- 0xfed00:$s1: " --AutoStart
- 0x102948:$s2: --ForNetRes
- 0x102910:$s3: --Admin
- 0x102d90:$s4: %username%
- 0x102eb4:$s5: ?pid=
- 0x102ec0:$s6: &first=true
- 0x102ed8:$s6: &first=false
- 0xfedf4:$s7: delself.bat
- 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.2.253.exe.400000.0.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
15.3.959.exe.800000.0.unpack | JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | |
18.0.253.exe.400000.7.raw.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe23ea:$s1: http://
- 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe23ea:$f1: http://
|
18.0.253.exe.400000.7.raw.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.7.raw.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xffe88:$x1: C:\SystemID\PersonalID.txt
- 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0x1002ec:$s1: " --AutoStart
- 0x100300:$s1: " --AutoStart
- 0x103f48:$s2: --ForNetRes
- 0x103f10:$s3: --Admin
- 0x104390:$s4: %username%
- 0x1044b4:$s5: ?pid=
- 0x1044c0:$s6: &first=true
- 0x1044d8:$s6: &first=false
- 0x1003f4:$s7: delself.bat
- 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.7.raw.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.2.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.6.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe0dea:$s1: http://
- 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe0dea:$f1: http://
|
18.0.253.exe.400000.6.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.6.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfe888:$x1: C:\SystemID\PersonalID.txt
- 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfecec:$s1: " --AutoStart
- 0xfed00:$s1: " --AutoStart
- 0x102948:$s2: --ForNetRes
- 0x102910:$s3: --Admin
- 0x102d90:$s4: %username%
- 0x102eb4:$s5: ?pid=
- 0x102ec0:$s6: &first=true
- 0x102ed8:$s6: &first=false
- 0xfedf4:$s7: delself.bat
- 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.6.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
15.3.959.exe.800000.0.raw.unpack | JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | |
18.0.253.exe.400000.8.raw.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe23ea:$s1: http://
- 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe23ea:$f1: http://
|
18.0.253.exe.400000.8.raw.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.8.raw.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xffe88:$x1: C:\SystemID\PersonalID.txt
- 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0x1002ec:$s1: " --AutoStart
- 0x100300:$s1: " --AutoStart
- 0x103f48:$s2: --ForNetRes
- 0x103f10:$s3: --Admin
- 0x104390:$s4: %username%
- 0x1044b4:$s5: ?pid=
- 0x1044c0:$s6: &first=true
- 0x1044d8:$s6: &first=false
- 0x1003f4:$s7: delself.bat
- 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.8.raw.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.10.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe0dea:$s1: http://
- 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe0dea:$f1: http://
|
18.0.253.exe.400000.10.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.10.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfe888:$x1: C:\SystemID\PersonalID.txt
- 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfecec:$s1: " --AutoStart
- 0xfed00:$s1: " --AutoStart
- 0x102948:$s2: --ForNetRes
- 0x102910:$s3: --Admin
- 0x102d90:$s4: %username%
- 0x102eb4:$s5: ?pid=
- 0x102ec0:$s6: &first=true
- 0x102ed8:$s6: &first=false
- 0xfedf4:$s7: delself.bat
- 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.10.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.5.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe0dea:$s1: http://
- 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe0dea:$f1: http://
|
18.0.253.exe.400000.5.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.5.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfe888:$x1: C:\SystemID\PersonalID.txt
- 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfecec:$s1: " --AutoStart
- 0xfed00:$s1: " --AutoStart
- 0x102948:$s2: --ForNetRes
- 0x102910:$s3: --Admin
- 0x102d90:$s4: %username%
- 0x102eb4:$s5: ?pid=
- 0x102ec0:$s6: &first=true
- 0x102ed8:$s6: &first=false
- 0xfedf4:$s7: delself.bat
- 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.5.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.9.raw.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe23ea:$s1: http://
- 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe23ea:$f1: http://
|
18.0.253.exe.400000.9.raw.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.9.raw.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xffe88:$x1: C:\SystemID\PersonalID.txt
- 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0x1002ec:$s1: " --AutoStart
- 0x100300:$s1: " --AutoStart
- 0x103f48:$s2: --ForNetRes
- 0x103f10:$s3: --Admin
- 0x104390:$s4: %username%
- 0x1044b4:$s5: ?pid=
- 0x1044c0:$s6: &first=true
- 0x1044d8:$s6: &first=false
- 0x1003f4:$s7: delself.bat
- 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.9.raw.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.8.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe0dea:$s1: http://
- 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe0dea:$f1: http://
|
18.0.253.exe.400000.8.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.8.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfe888:$x1: C:\SystemID\PersonalID.txt
- 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfecec:$s1: " --AutoStart
- 0xfed00:$s1: " --AutoStart
- 0x102948:$s2: --ForNetRes
- 0x102910:$s3: --Admin
- 0x102d90:$s4: %username%
- 0x102eb4:$s5: ?pid=
- 0x102ec0:$s6: &first=true
- 0x102ed8:$s6: &first=false
- 0xfedf4:$s7: delself.bat
- 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.8.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
14.2.253.exe.23d15a0.1.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xdf7ea:$s1: http://
- 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xdf7ea:$f1: http://
|
14.2.253.exe.23d15a0.1.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
14.2.253.exe.23d15a0.1.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfd288:$x1: C:\SystemID\PersonalID.txt
- 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfd6ec:$s1: " --AutoStart
- 0xfd700:$s1: " --AutoStart
- 0x101348:$s2: --ForNetRes
- 0x101310:$s3: --Admin
- 0x101790:$s4: %username%
- 0x1018b4:$s5: ?pid=
- 0x1018c0:$s6: &first=true
- 0x1018d8:$s6: &first=false
- 0xfd7f4:$s7: delself.bat
- 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
14.2.253.exe.23d15a0.1.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.4.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe0dea:$s1: http://
- 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe0dea:$f1: http://
|
18.0.253.exe.400000.4.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.4.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfe888:$x1: C:\SystemID\PersonalID.txt
- 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfecec:$s1: " --AutoStart
- 0xfed00:$s1: " --AutoStart
- 0x102948:$s2: --ForNetRes
- 0x102910:$s3: --Admin
- 0x102d90:$s4: %username%
- 0x102eb4:$s5: ?pid=
- 0x102ec0:$s6: &first=true
- 0x102ed8:$s6: &first=false
- 0xfedf4:$s7: delself.bat
- 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.4.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.1.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.10.raw.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe23ea:$s1: http://
- 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe23ea:$f1: http://
|
18.0.253.exe.400000.10.raw.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.10.raw.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xffe88:$x1: C:\SystemID\PersonalID.txt
- 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0x1002ec:$s1: " --AutoStart
- 0x100300:$s1: " --AutoStart
- 0x103f48:$s2: --ForNetRes
- 0x103f10:$s3: --Admin
- 0x104390:$s4: %username%
- 0x1044b4:$s5: ?pid=
- 0x1044c0:$s6: &first=true
- 0x1044d8:$s6: &first=false
- 0x1003f4:$s7: delself.bat
- 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.10.raw.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.9.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe0dea:$s1: http://
- 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe0dea:$f1: http://
|
18.0.253.exe.400000.9.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.9.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfe888:$x1: C:\SystemID\PersonalID.txt
- 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfecec:$s1: " --AutoStart
- 0xfed00:$s1: " --AutoStart
- 0x102948:$s2: --ForNetRes
- 0x102910:$s3: --Admin
- 0x102d90:$s4: %username%
- 0x102eb4:$s5: ?pid=
- 0x102ec0:$s6: &first=true
- 0x102ed8:$s6: &first=false
- 0xfedf4:$s7: delself.bat
- 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.9.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
14.2.253.exe.23d15a0.1.raw.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe0dea:$s1: http://
- 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe0dea:$f1: http://
|
14.2.253.exe.23d15a0.1.raw.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
14.2.253.exe.23d15a0.1.raw.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xfe888:$x1: C:\SystemID\PersonalID.txt
- 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0xfecec:$s1: " --AutoStart
- 0xfed00:$s1: " --AutoStart
- 0x102948:$s2: --ForNetRes
- 0x102910:$s3: --Admin
- 0x102d90:$s4: %username%
- 0x102eb4:$s5: ?pid=
- 0x102ec0:$s6: &first=true
- 0x102ed8:$s6: &first=false
- 0xfedf4:$s7: delself.bat
- 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
14.2.253.exe.23d15a0.1.raw.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
18.0.253.exe.400000.6.raw.unpack | SUSP_XORed_URL_in_EXE | Detects an XORed URL in an executable | Florian Roth | - 0xe23ea:$s1: http://
- 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF
- 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF
- 0xe23ea:$f1: http://
|
18.0.253.exe.400000.6.raw.unpack | JoeSecurity_Djvu | Yara detected Djvu Ransomware | Joe Security | |
18.0.253.exe.400000.6.raw.unpack | MALWARE_Win_STOP | Detects STOP ransomware | ditekSHen | - 0xffe88:$x1: C:\SystemID\PersonalID.txt
- 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
- 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\
- 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\
- 0x1002ec:$s1: " --AutoStart
- 0x100300:$s1: " --AutoStart
- 0x103f48:$s2: --ForNetRes
- 0x103f10:$s3: --Admin
- 0x104390:$s4: %username%
- 0x1044b4:$s5: ?pid=
- 0x1044c0:$s6: &first=true
- 0x1044d8:$s6: &first=false
- 0x1003f4:$s7: delself.bat
- 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
- 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
- 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
|
18.0.253.exe.400000.6.raw.unpack | Windows_Ransomware_Stop_1e8d48ff | unknown | unknown | - 0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
- 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
|
Click to see the 74 entries |