88i.jp.net_nano.exe
Ransomware with C2, keylogger, hollowing
.NET AES bulk file encryptor with ransom contextDynamically resolved process-hollowing API chain
SHA-2569d29978a66049566ed4cb6d9c9345b6d088758e4ca4e100b4a0ace63164a361b
Evidence
⋯7 more rows
0x6530bf060000ce0600001200000000000000................
0x654042534a4201000100000000000c000000BSJB............
0x655076342e302e3330333139000000000500v4.0.30319......
⋯15 more rows
⋯13 more rows
0x8b6d485f4b4559424f4152445f4c4c00574dH_KEYBOARD_LL.WM
0x8b7d5f4b4559444f574e0053575f48494445_KEYDOWN.SW_HIDE
0x8b8d0053575f53484f570050524f43455353.SW_SHOW.PROCESS
⋯10 more rows
0x8c3d005468726561644869646546726f6d44.ThreadHideFromD
0x8c4d65627567676572005350495f53455444ebugger.SPI_SETD
0x8c5d45534b57414c4c504150455200535049ESKWALLPAPER.SPI
0x8c6d465f555044415445494e4946494c4500F_UPDATEINIFILE.
⋯6 more rows
0x8cdd52494748545550004d4f555345455645RIGHTUP.MOUSEEVE
0x8ced4e54465f574845454c00435245415445NTF_WHEEL.CREATE
0x8cfd5f53555350454e44454400434f4e5445_SUSPENDED.CONTE
0x8d0d58545f46554c4c00544f4b454e5f5155XT_FULL.TOKEN_QU
⋯8 more rows
⋯8 more rows
0x8e6c00556e686f6f6b57696e646f7773486f.UnhookWindowsHo
0x8e7c6f6b45780043616c6c4e657874486f6fokEx.CallNextHoo
0x8e8c6b4578004765744d6f64756c6548616ekEx.GetModuleHan
0x8e9c646c65004765744173796e634b657953dle.GetAsyncKeyS
0x8eac7461746500476574466f726567726f75tate.GetForegrou
0x8ebc6e6457696e646f770053797374656d2endWindow.System.
0x8ecc5465787400537472696e674275696c64Text.StringBuild
0x8edc65720047657457696e646f7754657874er.GetWindowText
0x8eec004f70656e436c6970626f6172640043.OpenClipboard.C
0x8efc6c6f7365436c6970626f617264004765loseClipboard.Ge
0x8f0c74436c6970626f617264446174610047tClipboardData.G
0x8f1c6c6f62616c4c6f636b00476c6f62616clobalLock.Global
0x8f2c556e6c6f636b00497344656275676765Unlock.IsDebugge
0x8f3c7250726573656e740053686f7757696erPresent.ShowWin
0x8f4c646f770046696e6457696e646f770047dow.FindWindow.G
0x8f5c657443757272656e7450726f63657373etCurrentProcess
0x8f6c00436865636b52656d6f746544656275.CheckRemoteDebu
0x8f7c6767657250726573656e7400426c6f63ggerPresent.Bloc
0x8f8c6b496e707574005669727475616c416ckInput.VirtualAl
0x8f9c6c6f63457800577269746550726f6365locEx.WriteProce
0x8fac73734d656d6f72790043726561746552ssMemory.CreateR
0x8fbc656d6f7465546872656164004f70656eemoteThread.Open
0x8fcc50726f63657373004e74536574496e66Process.NtSetInf
0x8fdc6f726d6174696f6e5468726561640047ormationThread.G
0x8fec657443757272656e7454687265616400etCurrentThread.
0x8ffc53797374656d506172616d6574657273SystemParameters
0x900c496e666f004578697457696e646f7773Info.ExitWindows
0x901c457800536574437572736f72506f7300Ex.SetCursorPos.
0x902c6d6f7573655f6576656e740052656164mouse_event.Read
0x903c50726f636573734d656d6f7279004765ProcessMemory.Ge
0x904c74546872656164436f6e746578740053tThreadContext.S
0x905c6574546872656164436f6e7465787400etThreadContext.
0x906c526573756d65546872656164005a7755ResumeThread.ZwU
0x907c6e6d6170566965774f6653656374696fnmapViewOfSectio
0x908c6e004f70656e50726f63657373546f6bn.OpenProcessTok
0x909c656e004c6f6f6b757050726976696c65en.LookupPrivile
0x90ac676556616c75650041646a757374546fgeValue.AdjustTo
0x90bc6b656e50726976696c65676573004372kenPrivileges.Cr
0x90cc6561746550726f63657373005f6b6579eateProcess._key
0x90dc626f61726450726f63005f686f6f6b49boardProc._hookI
⋯14 more rows
0xbe046c006f00670000092e00620061006b00l.o.g.....b.a.k.
0xbe14000f7400610073006b006d0067007200..t.a.s.k.m.g.r.
0xbe24000f7200650067006500640069007400..r.e.g.e.d.i.t.
0xbe3400116d00730063006f006e0066006900..m.s.c.o.n.f.i.
0xbe446700000f700072006f00630065007800g...p.r.o.c.e.x.
0xbe547000001b700072006f00630065007300p...p.r.o.c.e.s.
0xbe6473006800610063006b00650072000013s.h.a.c.k.e.r...
0xbe7477006900720065007300680061007200w.i.r.e.s.h.a.r.
0xbe846b00000f66006900640064006c006500k...f.i.d.d.l.e.
0xbe94720000096e006d006100700000156d00r...n.m.a.p...m.
0xbea4650074006100730070006c006f006900e.t.a.s.p.l.o.i.
0xbeb47400000f6f006c006c00790064006200t...o.l.l.y.d.b.
0xbec46700000d780036003400640062006700g...x.6.4.d.b.g.
⋯5 more rows
0xbf246c0062006f007800000d76006d007700l.b.o.x...v.m.w.
0xbf34610072006500001361006e0074006900a.r.e...a.n.t.i.
0xbf4476006900720075007300000b61007600v.i.r.u.s...a.v.
0xbf546100730074000007610076006700000ba.s.t...a.v.g...
0xbf6461007600690072006100001762006900a.v.i.r.a...b.i.
0xbf74740064006500660065006e0064006500t.d.e.f.e.n.d.e.
0xbf84720000136b0061007300700065007200r...k.a.s.p.e.r.
0xbf9473006b007900000d6d00630061006600s.k.y...m.c.a.f.
0xbfa465006500000d6e006f00720074006f00e.e...n.o.r.t.o.
0xbfb46e000011730079006d0061006e007400n...s.y.m.a.n.t.
0xbfc46500630000196d0061006c0077006100e.c...m.a.l.w.a.
0xbfd47200650062007900740065007300000dr.e.b.y.t.e.s...
0xbfe4770073006300730076006300002b5300w.s.c.s.v.c..+S.
0xbff465006300750072006900740079004800e.c.u.r.i.t.y.H.
0xc004650061006c0074006800530065007200e.a.l.t.h.S.e.r.
0xc01476006900630065000013570069006e00v.i.c.e...W.i.n.
0xd87f62006900740064006500660065006e00b.i.t.d.e.f.e.n.
0xd88f6400650072002e0063006f006d000011d.e.r...c.o.m...
0xd89f65007300650074002e0063006f006d00e.s.e.t...c.o.m.
0xd8af001d7400720065006e0064006d006900..t.r.e.n.d.m.i.
0xd8bf630072006f002e0063006f006d000021c.r.o...c.o.m..!
0xd8cf6d0061006c0077006100720065006200m.a.l.w.a.r.e.b.
0xd8df79007400650073002e0063006f006d00y.t.e.s...c.o.m.
0xd8ef001d7600690072007500730074006f00..v.i.r.u.s.t.o.
0xd8ff740061006c002e0063006f006d000015t.a.l...c.o.m...
⋯3 more rows