Samples
Password for every archive: infected.
| Build | SHA-256 | MD5 | Archive |
|---|---|---|---|
| Build 1 | 101bd45ab673fd6547386dff4339f1649e61b9f5c318260d365f766fbdc2d3c9 |
427eba9f6ff2cd312c72770f13e279c1 |
101bd45ab673fd6547386dff4339f1649e61b9f5c318260d365f766fbdc2d3c9.zip |
| Build 2 | 988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42 |
4aecef9ddc8d07b82a6902b27f051f34 |
988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42.zip |
Both are live ransomware. Run them only in an isolated, snapshotted VM. In every controlled run here, the sample was launched with
--encryption_path=<test folder> -localonly, and the shadow-copy WMI executor was forced to return. Without
--encryption_path it sweeps local drives.