socolivesa.io_nano.exe
Ransomware with C2, keylogger, hollowing
.NET AES bulk file encryptor with ransom contextDynamically resolved process-hollowing API chain
SHA-25695d2082afbfcdc1e484c8a0bc3e3232d6f136b1c80a3e0d91dfd9bb6a96dd5b3
Evidence
⋯7 more rows
0x6530bf060000ce0600001200000000000000................
0x654042534a4201000100000000000c000000BSJB............
0x655076342e302e3330333139000000000500v4.0.30319......
⋯15 more rows
⋯13 more rows
0x8b70485f4b4559424f4152445f4c4c00574dH_KEYBOARD_LL.WM
0x8b805f4b4559444f574e0053575f48494445_KEYDOWN.SW_HIDE
0x8b900053575f53484f570050524f43455353.SW_SHOW.PROCESS
⋯10 more rows
0x8c40005468726561644869646546726f6d44.ThreadHideFromD
0x8c5065627567676572005350495f53455444ebugger.SPI_SETD
0x8c6045534b57414c4c504150455200535049ESKWALLPAPER.SPI
0x8c70465f555044415445494e4946494c4500F_UPDATEINIFILE.
⋯6 more rows
0x8ce052494748545550004d4f555345455645RIGHTUP.MOUSEEVE
0x8cf04e54465f574845454c00435245415445NTF_WHEEL.CREATE
0x8d005f53555350454e44454400434f4e5445_SUSPENDED.CONTE
0x8d1058545f46554c4c00544f4b454e5f5155XT_FULL.TOKEN_QU
⋯8 more rows
⋯8 more rows
0x8e6f00556e686f6f6b57696e646f7773486f.UnhookWindowsHo
0x8e7f6f6b45780043616c6c4e657874486f6fokEx.CallNextHoo
0x8e8f6b4578004765744d6f64756c6548616ekEx.GetModuleHan
0x8e9f646c65004765744173796e634b657953dle.GetAsyncKeyS
0x8eaf7461746500476574466f726567726f75tate.GetForegrou
0x8ebf6e6457696e646f770053797374656d2endWindow.System.
0x8ecf5465787400537472696e674275696c64Text.StringBuild
0x8edf65720047657457696e646f7754657874er.GetWindowText
0x8eef004f70656e436c6970626f6172640043.OpenClipboard.C
0x8eff6c6f7365436c6970626f617264004765loseClipboard.Ge
0x8f0f74436c6970626f617264446174610047tClipboardData.G
0x8f1f6c6f62616c4c6f636b00476c6f62616clobalLock.Global
0x8f2f556e6c6f636b00497344656275676765Unlock.IsDebugge
0x8f3f7250726573656e740053686f7757696erPresent.ShowWin
0x8f4f646f770046696e6457696e646f770047dow.FindWindow.G
0x8f5f657443757272656e7450726f63657373etCurrentProcess
0x8f6f00436865636b52656d6f746544656275.CheckRemoteDebu
0x8f7f6767657250726573656e7400426c6f63ggerPresent.Bloc
0x8f8f6b496e707574005669727475616c416ckInput.VirtualAl
0x8f9f6c6f63457800577269746550726f6365locEx.WriteProce
0x8faf73734d656d6f72790043726561746552ssMemory.CreateR
0x8fbf656d6f7465546872656164004f70656eemoteThread.Open
0x8fcf50726f63657373004e74536574496e66Process.NtSetInf
0x8fdf6f726d6174696f6e5468726561640047ormationThread.G
0x8fef657443757272656e7454687265616400etCurrentThread.
0x8fff53797374656d506172616d6574657273SystemParameters
0x900f496e666f004578697457696e646f7773Info.ExitWindows
0x901f457800536574437572736f72506f7300Ex.SetCursorPos.
0x902f6d6f7573655f6576656e740052656164mouse_event.Read
0x903f50726f636573734d656d6f7279004765ProcessMemory.Ge
0x904f74546872656164436f6e746578740053tThreadContext.S
0x905f6574546872656164436f6e7465787400etThreadContext.
0x906f526573756d65546872656164005a7755ResumeThread.ZwU
0x907f6e6d6170566965774f6653656374696fnmapViewOfSectio
0x908f6e004f70656e50726f63657373546f6bn.OpenProcessTok
0x909f656e004c6f6f6b757050726976696c65en.LookupPrivile
0x90af676556616c75650041646a757374546fgeValue.AdjustTo
0x90bf6b656e50726976696c65676573004372kenPrivileges.Cr
0x90cf6561746550726f63657373005f6b6579eateProcess._key
0x90df626f61726450726f63005f686f6f6b49boardProc._hookI
⋯14 more rows
0xbe0c6c006f00670000092e00620061006b00l.o.g.....b.a.k.
0xbe1c000f7400610073006b006d0067007200..t.a.s.k.m.g.r.
0xbe2c000f7200650067006500640069007400..r.e.g.e.d.i.t.
0xbe3c00116d00730063006f006e0066006900..m.s.c.o.n.f.i.
0xbe4c6700000f700072006f00630065007800g...p.r.o.c.e.x.
0xbe5c7000001b700072006f00630065007300p...p.r.o.c.e.s.
0xbe6c73006800610063006b00650072000013s.h.a.c.k.e.r...
0xbe7c77006900720065007300680061007200w.i.r.e.s.h.a.r.
0xbe8c6b00000f66006900640064006c006500k...f.i.d.d.l.e.
0xbe9c720000096e006d006100700000156d00r...n.m.a.p...m.
0xbeac650074006100730070006c006f006900e.t.a.s.p.l.o.i.
0xbebc7400000f6f006c006c00790064006200t...o.l.l.y.d.b.
0xbecc6700000d780036003400640062006700g...x.6.4.d.b.g.
⋯5 more rows
0xbf2c6c0062006f007800000d76006d007700l.b.o.x...v.m.w.
0xbf3c610072006500001361006e0074006900a.r.e...a.n.t.i.
0xbf4c76006900720075007300000b61007600v.i.r.u.s...a.v.
0xbf5c6100730074000007610076006700000ba.s.t...a.v.g...
0xbf6c61007600690072006100001762006900a.v.i.r.a...b.i.
0xbf7c740064006500660065006e0064006500t.d.e.f.e.n.d.e.
0xbf8c720000136b0061007300700065007200r...k.a.s.p.e.r.
0xbf9c73006b007900000d6d00630061006600s.k.y...m.c.a.f.
0xbfac65006500000d6e006f00720074006f00e.e...n.o.r.t.o.
0xbfbc6e000011730079006d0061006e007400n...s.y.m.a.n.t.
0xbfcc6500630000196d0061006c0077006100e.c...m.a.l.w.a.
0xbfdc7200650062007900740065007300000dr.e.b.y.t.e.s...
0xbfec770073006300730076006300002b5300w.s.c.s.v.c..+S.
0xbffc65006300750072006900740079004800e.c.u.r.i.t.y.H.
0xc00c650061006c0074006800530065007200e.a.l.t.h.S.e.r.
0xc01c76006900630065000013570069006e00v.i.c.e...W.i.n.
0xd88d62006900740064006500660065006e00b.i.t.d.e.f.e.n.
0xd89d6400650072002e0063006f006d000011d.e.r...c.o.m...
0xd8ad65007300650074002e0063006f006d00e.s.e.t...c.o.m.
0xd8bd001d7400720065006e0064006d006900..t.r.e.n.d.m.i.
0xd8cd630072006f002e0063006f006d000021c.r.o...c.o.m..!
0xd8dd6d0061006c0077006100720065006200m.a.l.w.a.r.e.b.
0xd8ed79007400650073002e0063006f006d00y.t.e.s...c.o.m.
0xd8fd001d7600690072007500730074006f00..v.i.r.u.s.t.o.
0xd90d740061006c002e0063006f006d000015t.a.l...c.o.m...
⋯3 more rows