【インディケータ情報】
■ハッシュ情報(MD5)
6F772EB660BC05FC26DF86C98CA49ABC
911D5905CBE1DD462F171B7167CD15B9
【マルウェア情報】
■7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2
| MD5 | 6f772eb660bc05fc26df86c98ca49abc |
| SHA1 | 8da75dd328c195b84f15740a33fc9888af4da2be |
| SHA256 | 7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2 |
| SHA512 | |
| SSDEEP | 1536:USX6DdHTs0Zwboo0z29sHH3ga/7/nvvgDD0jj0ZT8fS4D0rF4p4sxVZ7:36BZwlOn4DdTBDiusxVZ7 |
| authentihash | 3416f2ade2d7b9fb6e53999d224c02c0937d6715059715d4f53131248b519ecc |
| imphash | |
| File Size | 141824 bytes |
| File Type | Win32 EXE |
| コンパイル日時 | 2017-07-01 00:00:00 |
| Debug Path | |
| File Name | |
| File Path | |
| 生成ファイル | |
| 特徴 | |
| 参考情報 | https://www.virustotal.com/ja/file/7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2/analysis/ |
| Section | MD5 |
|---|---|
| all | 6f772eb660bc05fc26df86c98ca49abc |
| .text | b155e0b2a76ddf73dc979e90d298fd6c |
| .rdata | 37a224d460f8bfa9cb1ca29379cb4206 |
| .data | f6fc7edeb1554eafa53684da66a448c7 |
| .pdata | f5b76bd22e52e92bd67ba2c789e3aa0c |
| .reloc | 3b571bb98409f1b87bbb803d0cdfceee |
■8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051
| MD5 | 911d5905cbe1dd462f171b7167cd15b9 |
| SHA1 | bca38ab2f4b461e25e4686cfe523d3b0ed2d1cd0 |
| SHA256 | 8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051 |
| SHA512 | |
| SSDEEP | 1536:IhcFu21x8xUoDq88z/1h5jOla6H7uTnkwwZI0qXAREZ+QOS4D0rtJ/lxABC:7DnoDjbin/w1O3D5J/lxABC |
| authentihash | ccdc84f3127d66b319031a6aff4f30fc74dc7cff835368904c1fc099f38827b2 |
| imphash | |
| File Size | 141824 bytes |
| File Type | Win32 EXE(x64) |
| コンパイル日時 | 2017-07-01 00:00:00 |
| Debug Path | |
| File Name | |
| File Path | |
| 生成ファイル | |
| 特徴 | |
| 参考情報 | https://www.virustotal.com/ja/file/8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051/analysis/ |
| Section | MD5 |
|---|---|
| all | 911d5905cbe1dd462f171b7167cd15b9 |
| .text | 41597aee0b13790efbf45dc18979ee07 |
| .rdata | 9ccf8afe0fcab189ee299cdbcb456fb0 |
| .data | e58fdb7f80d5c71dfc7d1999cf5dffb1 |
| .pdata | f9005700885a7e59b39aff0be3933aa7 |
| .reloc | 51b34d2fe320deb720744a298a64a92a |
【ブログ】
◆SynAck targeted ransomware uses the Doppelgänging technique (SecureList, 2018/05/07)
https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/
【関連まとめ記事】
◆Process Doppelgänging (まとめ)
https://malware-log.hatenablog.com/entry/Process_Doppelganging
