Hostile ^92% Download

2026-09-28_fc3ebe4f2f881f49ce90c050622ffbee_cryptolocker_elex

CryptoLocker ransomware variant

Detection of CryptoLocker VariantsHash-named sandbox temporary path

SHA-256ef2c472c8c50ec0e0e50421f3e8bfcb0618f44d6811277c5e23299de93860dba

URLhttps://tria.ge/api/v0/samples/260928-z49dxavtf1/sample

MaleculeK(Am₂)H₄(F₆Os₂PoU)Md₃(Bi₄PaSi)Th

Evidence

GUI command handler calls global buffer pointer 0x2aa7–0x2b67

⋯3 more rows
0x2ad700a11e410008508b4508a32c44000858...A..P.E..,D..X
0x2ae785c07507a17c440008ffd040506a0068..u..|[email protected]
0x2af711010000ff7508ff157c400008eb0300.....u...|@.....
⋯7 more rows

Detection of CryptoLocker Variants 0x33df–0x355f

⋯7 more rows
0x344f61746963007175696261006564697400atic.quiba.edit.
0x345f627574746f6e00756e6f206d6f6d656ebutton.uno momen
0x346f746f005005f400890a002164250000d7to.P......!d%...
⋯15 more rows

Close directory enumeration handle 0x3c34–0x3e64

⋯8 more rows
0x3cb46f736548616e646c6500690044656c65oseHandle.i.Dele
0x3cc4746546696c654100ba0046696e644e65teFileA...FindNe
0x3cd4787446696c6541001c0147657446696cxtFileA...GetFil
0x3ce46553697a6500ad0046696e64436c6f73eSize...FindClos
0x3cf46500fe0047657443757272656e744469e...GetCurrentDi
0x3d04726563746f7279410000b10046696e64rectoryA....Find
0x3d14466972737446696c65410000e6004765FirstFileA....Ge
0x3d2474436f6d6d616e644c696e6541003401tCommandLineA.4.
⋯20 more rows

GUI import cluster BeginPaint 0x3eb2–0x41a2

⋯7 more rows
0x3f2200005a01000000000000000000000c00..Z.............
0x3f324900440052005f005600450052005300I.D.R._.V.E.R.S.
0x3f4249004f004e0031000000000000003c61I.O.N.1.......<a
0x3f527373656d626c7920786d6c6e733d2275ssembly xmlns="u
0x3f62726e3a736368656d61732d6d6963726frn:schemas-micro
0x3f72736f66742d636f6d3a61736d2e763122soft-com:asm.v1"
0x3f82206d616e696665737456657273696f6e manifestVersion
0x3f923d22312e30223e0d0a20203c74727573="1.0">..  <trus
0x3fa274496e666f20786d6c6e733d2275726etInfo xmlns="urn
0x3fb23a736368656d61732d6d6963726f736f:schemas-microso
0x3fc266742d636f6d3a61736d2e7633223e0dft-com:asm.v3">.
0x3fd20a202020203c73656375726974793e0d.    <security>.
0x3fe20a2020202020203c7265717565737465.      <requeste
0x3ff26450726976696c656765733e0d0a2020dPrivileges>..  
0x40022020202020203c726571756573746564      <requested
0x4012457865637574696f6e4c6576656c206cExecutionLevel l
0x40226576656c3d226173496e766f6b657222evel="asInvoker"
0x40322075694163636573733d2266616c7365 uiAccess="false
0x4042223e3c2f726571756573746564457865"></requestedExe
0x4052637574696f6e4c6576656c3e0d0a2020cutionLevel>..  
0x4062202020203c2f72657175657374656450    </requestedP
0x4072726976696c656765733e0d0a20202020rivileges>..    
0x40823c2f73656375726974793e0d0a20203c</security>..  <
0x40922f7472757374496e666f3e0d0a3c2f61/trustInfo>..</a
0x40a27373656d626c793e0000000000009801ssembly>........
0x40b234000000560053005f005600450052004...V.S._.V.E.R.
0x40c2530049004f004e005f0049004e004600S.I.O.N._.I.N.F.
⋯6 more rows
0x4132300034004500330000003000080001000.4.E.3...0.....
0x4142460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0x415269006f006e000000000032002e003000i.o.n.....2...0.
0x41622e0031002e0037000000340008000100..1...7...4.....
0x4172500072006f0064007500630074005600P.r.o.d.u.c.t.V.
0x418265007200730069006f006e0000003200e.r.s.i.o.n...2.
0x41922e0030002e0031002e00300000003600..0...1...0...6.
0x41a20b00010043006f006d00700061006e00....C.o.m.p.a.n.

Low-entropy data follows mapped binary image 0x65c0–0x68b0

⋯3 more rows
0x65f000000000000000000000000000000000................
0x660043003a005c0044004f00430055004d00C.:.\.D.O.C.U.M.
0x661045007e0031005c006500780070003100E.~.1.\.e.x.p.1.
0x66205c004c004f00430041004c0053007e00\.L.O.C.A.L.S.~.
0x663031005c00540065006d0070005c0052001.\.T.e.m.p.\.R.
0x664061007200240045005800300030002e00a.r.$.E.X.0.0...
0x66503700390036005c0055005300500053007.9.6.\.U.S.P.S.
0x66605f004c006100620065006c005f003000_.L.a.b.e.l._.0.
0x667033003100300032003000310033002e003.1.0.2.0.1.3...
0x66806500780065000000000043003a005c00e.x.e.....C.:.\.
0x669044006f0077006e006c006f0061006400D.o.w.n.l.o.a.d.
0x66a073005c00620061003700350065003000s.\.b.a.7.5.e.0.
0x66b0300030003000310032006200380030000.0.0.1.2.b.8.0.
0x66c065003700660035003600330036003900e.7.f.5.6.3.6.9.
0x66d0320033003000370061006200390065002.3.0.7.a.b.9.e.
0x66e0320033002e00650078006500000000002.3...e.x.e.....
0x66f043003a005c0044006f0077006e006c00C.:.\.D.o.w.n.l.
0x67006f006100640073005c00610035003000o.a.d.s.\.a.5.0.
0x6710350063006500370033003900300031005.c.e.7.3.9.0.1.
0x672061003400650031003100370038003900a.4.e.1.1.7.8.9.
0x673065003800360039003700620062003800e.8.6.9.7.b.b.8.
0x6740390062006100310062002e00650078009.b.a.1.b...e.x.
0x675065000000000043003a005c0044006f00e.....C.:.\.D.o.
0x676077006e006c006f006100640073005c00w.n.l.o.a.d.s.\.
0x6770330034006200320066003000370037003.4.b.2.f.0.7.7.
0x6780360035003800610035003000300034006.5.8.a.5.0.0.4.
0x679063003300610037003900630031006600c.3.a.7.9.c.1.f.
0x67a0370031006500300063006200350063007.1.e.0.c.b.5.c.
0x67b02e006500780065000000000043003a00..e.x.e.....C.:.
0x67c05c006d006400700078006b0066007200\.m.d.p.x.k.f.r.
0x67d075005c00770073006400610074006400u.\.w.s.d.a.t.d.
0x67e02e006500780065000000000043003a00..e.x.e.....C.:.
0x67f05c00550073006500720073005c006100\.U.s.e.r.s.\.a.
0x68007a007500720065005c0044006f007700z.u.r.e.\.D.o.w.
0x68106e006c006f006100640073005c003800n.l.o.a.d.s.\.8.
0x6820340063003600640062003300630032004.c.6.d.b.3.c.2.
0x6830390033003300350064003800630066009.3.3.5.d.8.c.f.
0x684065003000370061003400380034003300e.0.7.a.4.8.4.3.
0x6850310035003400390062003500300035001.5.4.9.b.5.0.5.
0x686034006300390064003600630061002e004.c.9.d.6.c.a...
0x68706500780065000000000043003a005c00e.x.e.....C.:.\.
0x688065006600640030006600370031003100e.f.d.0.f.7.1.1.
0x6890330035003200300030003600650066003.5.2.0.0.6.e.f.
0x68a066003100650061006200390064006300f.1.e.a.b.9.d.c.
0x68b039                              9               