2026-09-29_a1e11b517872579ad15913eda552a360_coinminer_cryptolocker_elex_mafia_stealc_tofsee
CryptoLocker, injection, evasion, packed
Detection of CryptoLocker VariantsDetection of Cryptolocker Samples
SHA-256947b48fe49553f9a4c488f6ec764c4062fda5d01b54bcc685d3bf6b006a68854
Evidence
⋯5 more rows
0x1d800000000000000000000000000000000................
0x1e855505830000000000030040000100000UPX0.....0......
0x1f800000000000400000000000000000000................
0x20800000000800000e05550583100000000........UPX1....
0x21800300200004004000022020000040000.0...@..."......
⋯11 more rows
⋯5 more rows
0x3d00000000000000000000000332e393100...........3.91.
0x3e0555058210d0902011c3a1ddcb3b02046UPX!.....:.... F
0x3f0c8390600c31e020000d80500260e004a.9..........&..J
0x400ffffffffe90e0000018b0685c0740a50.............t.P
0x410e80e01219f832600598366080083660c...!..&.Y.f...f.
0x42000c3837cfefeffff240400535774518b...|....$..SWtQ.
0x4307c24108b5c241485ff750485db744131|$..\$...u...tA1
0x440750857bafffd6f227ceb0d8b4e0803cfu.W...o"|...N...
0x450513f2346598906594d1fffbffbef1357Q?#FY..YM......W
0x460ff74241003c8575126256183c410017e.t$...WQ&%a....~
0x4805bc20c006a08b800022794204149a100[...j....'. AI..
0x49003a30cb904ffbfffff33f6ff500c83c0.........3..P...
0x4a0108945f0ff75088d050c8975fcff7510..E..u.....u..u.
0x4b0680002fedffdff5e18e80e00054e8b55h......^.....N.U
0x4c0f0568d4dec0bf9bc83c4148d7df0c645.V.M........}..E
0x4d0fc01ff7ff7ef0e01c38b45ec83c0f00a..........E.....
0x4e005998b7df0575656ff15000241dca3ff...}.WVV....A...
0x4f0fb3ff20003af4cd43db7000000740839.?....L.=....t.9
0x5003512750333f6468d21ec6eb04730c68b5.u.3.F.!.n.G0..
0x5104221c398431e1990db0c08895df610f2B!..C.......]...
0x520bd30729853885dfc9bffeedf038d45ec.0r.S.].......E.
0x530ce44508bcf3802045959ff305368fe80.DP..8..YY.0Sh..
0x5403df600000200a4d08bf02c3bf3740856=.........,;.t.V
0x550437f36d9c718d88b45f0dfc3ae8b0856C.6.....E......V
0x5608b37effeffff8d41f083ee103bc6742e.7.....A....;.t.
0x570837e0c007c1d8b103b167517535c03b9.~..|...;.u.S\..
0x5808bd837fcffbb8bd900059983c310891f..7.............
0x5905beb0bff71f48bc799000321fbef36fc[...q......!..6.
0x5a08bc75ec36a048826ba4d41498bf98b75..^.j..&.MAI...u
0x5b00833dbd87fbb3fbc8bc7895d1702598b.3....?....]..Y.
0x5c0c846027d13078b58f77f86fff4508b45.F.}...X.....P.E
0x5d00cc745f0014617a2ff750c8bf8560aff..E..F...u...V..
0x5e0bfe1fbb983c40c6a01448b008b48f085.......j.D...H..
0x5f0c974078b01ff50108f10e10ff485c075.t....P........u
0x6000de2ecff601023bcddffc385c9750a68....`.#......u.h
0x610054000803c05b128f906ffbb86ff8bc6.@..<..(........
0x620c38b0083e810e9ec993601c38d500266.........6...P.f
0x6308b084040fbbbffbb6632f62bc2d1f8c3..@@....f2.+....
0x640558bec5156ab8d041f508945fc418eddU..QV....P.E.A..
0x65086b702fb89f38bc70d039e321fff37fc...........2..7.
0x6608d047e53508b2700039e8b45fc8b5508..~SP.'....E..U.
0x67083c44204fbff77ff535ec9c38b0633c9..B...w.S^....3.
⋯10 more rows
0x369447363726970746f722700000000000000scriptor'.......
0x36954606c6f63616c20737461746963207468`local static th
0x3696472656164206775617264270000000000read guard'.....
⋯9 more rows
0x36a0420617465786974206465737472756374 atexit destruct
0x36a146f7220666f7220270000000000000000or for '........
0x36a246064796e616d696320696e697469616c`dynamic initial
⋯5 more rows
⋯7 more rows
0x42d3c586002005a010000e404000000000000X`..Z...........
0x42d4c3c617373656d626c7920786d6c6e733d<assembly xmlns=
0x42d5c2275726e3a736368656d61732d6d6963"urn:schemas-mic
0x42d6c726f736f66742d636f6d3a61736d2e76rosoft-com:asm.v
0x42d7c3122206d616e696665737456657273691" manifestVersi
0x42d8c6f6e3d22312e30223e0d0a20203c7472on="1.0">.. <tr
0x42d9c757374496e666f20786d6c6e733d2275ustInfo xmlns="u
0x42dac726e3a736368656d61732d6d6963726frn:schemas-micro
0x42dbc736f66742d636f6d3a61736d2e763322soft-com:asm.v3"
0x42dcc3e0d0a202020203c7365637572697479>.. <security
0x42ddc3e0d0a2020202020203c726571756573>.. <reques
0x42dec74656450726976696c656765733e0d0atedPrivileges>..
0x42dfc20202020202020203c72657175657374 <request
0x42e0c6564457865637574696f6e4c6576656cedExecutionLevel
0x42e1c206c6576656c3d226173496e766f6b65 level="asInvoke
0x42e2c72222075694163636573733d2266616cr" uiAccess="fal
0x42e3c7365223e3c2f72657175657374656445se"></requestedE
0x42e4c7865637574696f6e4c6576656c3e0d0axecutionLevel>..
0x42e5c2020202020203c2f7265717565737465 </requeste
0x42e6c6450726976696c656765733e0d0a2020dPrivileges>..
0x42e7c20203c2f73656375726974793e0d0a20 </security>..
0x42e8c203c2f7472757374496e666f3e0d0a3c </trustInfo>..<
0x42e9c2f617373656d626c793e504150414444/assembly>PAPADD
⋯15 more rows
⋯7 more rows
0x434ee000000000000f0ee0500600134000000..........`.4...
0x434fe560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x4350e4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x4357e300038003000340030003400620030000.8.0.4.0.4.b.0.
0x4359e560065007200730069006f006e000000V.e.r.s.i.o.n...
0x435ae0000320033002c00200039002c002000..2.3.,. .9.,. .
0x435be320030002c00200031003600310031002.0.,. .1.6.1.1.
0x435ce0000440010000100500072006f006400..D.....P.r.o.d.
0x435de75006300740056006500720073006900u.c.t.V.e.r.s.i.
0x435ee6f006e000000320033002c0020003900o.n...2.3.,. .9.
⋯14 more rows