Wana Decrypt0r.O Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 14,501 |
| Threat Level: | 100 % (High) |
| Infected Computers: | 204 |
| First Seen: | January 29, 2023 |
| Last Seen: | June 26, 2026 |
| OS(es) Affected: | Windows |
Wana Decrypt0r.O Ransomware is a file-encrypting threat that belongs to one of the most notorious ransomware lineages in modern computing history. The detection name is derived directly from the on-screen ransom interface that gave the family its public identity, and the sample analyzed here was submitted as a UPX-packed, 32-bit Windows executable that carries the tell-tale traits of aggressive file tampering and anti-analysis behavior.
Security engines flag payloads as Wana Decrypt0r.O Ransomware when they exhibit the encryption-and-extortion pattern associated with the WannaCry family. This report walks through what the threat is, how it spreads, what the sandbox observed, the concrete indicators of compromise pulled from the analyzed sample, and a complete removal workflow for infected systems.
Table of Contents
What Is Wana Decrypt0r.O Ransomware?
Wana Decrypt0r.O Ransomware is EnigmaSoft's detection for a variant tied to the WannaCry family, also publicly documented as WanaCrypt0r, WannaCryptor, WCry, and Wana Decrypt0r. "Wana Decrypt0r" is the literal title shown in the ransom window that WannaCry displays after it finishes encrypting a victim's files, which is why anti-malware vendors adopted the label for detections that match this behavior.
WannaCry rose to global prominence in May 2017, when it spread across hundreds of thousands of Windows machines in a matter of hours. What set it apart from ordinary ransomware was its worm component: it did not rely solely on a user opening an attachment, but actively propagated across networks on its own. Public threat intelligence, including Malpedia and multiple vendor write-ups, attributes the original WannaCry campaigns to the Lazarus Group, a North Korea-linked actor, based on code-reuse overlaps. In the classic outbreak, encrypted files were renamed with a .WNCRY extension and victims were presented with a Bitcoin ransom demand. Detections carrying the Wana Decrypt0r.O label indicate a binary whose structure and behavior line up with this lineage; the specifics of any single sample can differ from the original 2017 worm, so the family context below is provided for identification and should be read as general background rather than a claim about this exact binary.
How It Spreads / Distribution
The WannaCry family is historically defined by self-propagation. The original campaigns weaponized the EternalBlue exploit against a vulnerability in Microsoft's SMBv1 file-sharing protocol, allowing the malware to reach unpatched Windows hosts across a local network and the wider internet without any user interaction. Microsoft's MS17-010 update closed the underlying flaw, and systems that applied it were shielded from the SMB spreading mechanism.
Beyond the worm channel, ransomware in this class is also distributed through the common infection vectors that affect most Windows threats: malicious email attachments and phishing lures, trojanized or "cracked" software downloads, drive-by downloads from compromised sites, and secondary delivery by loaders already resident on a machine. The analyzed sample is packed with UPX, a runtime compression technique frequently used to shrink a payload and complicate static inspection, which is consistent with how such binaries are staged for delivery. Because concrete network delivery indicators were not present in the sandbox data for this sample, no command-and-control or download URLs are asserted here.
Technical Analysis & Behavior
The analyzed sample is a 32-bit (x86) Windows PE executable of roughly 8.9 MiB (9,317,888 bytes), compressed with the UPX packer and carrying no version information in its resource data, an omission that is typical of malware trying to blend in or avoid attribution. The automated sandbox recorded two behavior categories of note: anti_debug and user_data_access.
The anti_debug behavior indicates the binary contains logic to detect or resist analysis environments, a defensive measure meant to frustrate reverse engineering and delay detection. The user_data_access behavior is the more consequential signal for a ransomware payload: it reflects the sample reaching into user documents and data locations, precisely the activity expected from a threat that enumerates and encrypts victim files. The most striking metric from the run is the file-system impact: the sandbox observed 632 files modified during execution, with zero registry modifications recorded in this run. A large volume of file writes paired with negligible registry activity is a hallmark of bulk encryption, where the malware's energy is spent rewriting user data rather than establishing elaborate registry-based footholds. The PE header exposed 13 characteristic flags. No similar-family clustering was returned for this sample, and no signed-code provenance was found (see below).
Representative-sample disclaimer: the values above reflect one analyzed sample. Specific indicators such as hashes, file counts, and packers rotate between builds, and a different Wana Decrypt0r.O payload may show different figures.
Indicators of Compromise
The following indicators come directly from the analyzed sample and should be treated as one representative data point rather than a universal signature:
- SHA-256:
1F080B026DC6B23E1AB082D21B4F8F15A1DD2F07A70CD949033F1D12B2430508 - SHA-1:
d636fb13907769e2e0e6b642a24c3316ad50fdfb - MD5:
0eb9aebb7a081182975e980f2c726b72 - File size: 9,317,888 bytes (~8.9 MiB)
- Packer: UPX
- Architecture / traits: x86 PE, No Version Info
- Code signature: unsigned / invalid signature status; no signer or signing chain present
Because indicators rotate across builds, defenders should rely on behavioral detection in addition to these static hashes.
Detection Heuristics
Anti-malware engines identify threats like Wana Decrypt0r.O Ransomware through a layered mix of signatures and heuristics rather than a single fingerprint. Static heuristics flag the combination seen here: a UPX-packed x86 executable with stripped version information and an invalid or absent code signature, all classic "low-trust binary" markers. PE-structure heuristics weigh the header characteristic flags and the mismatch between the packed on-disk form and the unpacked runtime image.
Behavioral heuristics carry the most weight for ransomware. Engines watch for the anti_debug maneuvers that indicate analysis evasion and, critically, for the user_data_access plus high-volume file-modification pattern (over 600 files touched in a single run) that betrays mass encryption. A process that rapidly opens, reads, and overwrites large numbers of documents while resisting inspection is scored as ransomware even when its exact hash has never been seen before, which is what allows SpyHunter and similar tools to catch fresh variants of this family.
Digital Forensics
Investigators triaging a suspected Wana Decrypt0r.O infection should focus on the artifacts the sandbox behavior implies. On the file system, look for the aftermath of the roughly 632 file modifications observed in analysis: bursts of recently rewritten documents, renamed files, and dropped ransom-note artifacts across user profile directories. Because this run showed zero registry modifications, registry-based persistence may be minimal for this sample, but analysts should still audit common autorun locations (Run/RunOnce keys, Startup folders, and scheduled tasks) since related builds vary.
Process forensics should center on a single high-CPU process performing sustained read/write cycles against user data, exhibiting the anti-debug traits noted in analysis. Preserve the offending binary by its hashes (MD5 0eb9aebb7a081182975e980f2c726b72 / SHA-256 1F080B0...B2430508), capture memory before shutdown where possible, and, given the family's historical worm nature, review network logs and SMB activity for lateral-movement attempts and confirm that MS17-010 is applied across the environment. Volume Shadow Copies should be checked, as ransomware in this class commonly targets them to block easy recovery.
Symptoms of Infection
Victims of a WannaCry-class infection typically notice a sudden, dramatic set of symptoms:
- Files become inaccessible and may be renamed with an unfamiliar extension.
- A full-screen or window-based ransom message titled in the style of "Wana Decrypt0r" appears, demanding cryptocurrency payment for a decryption key.
- Documents, images, and archives fail to open in their normal applications.
- System performance degrades sharply while large numbers of files are being encrypted.
- Backup and shadow-copy recovery options may be disabled or missing.
- On networked systems, multiple machines may show signs of infection near-simultaneously.
How to Remove Wana Decrypt0r.O Ransomware
Act quickly and isolate the machine from the network first to limit any spreading. Then proceed with a thorough cleanup.
1. Run a full anti-malware scan. Install and update SpyHunter, then run a complete system scan. Let the tool detect and quarantine every component of Wana Decrypt0r.O Ransomware and any related payloads it identifies. A full scan (not a quick scan) is essential because ransomware droppers often stage multiple files.
2. Boot into Safe Mode with Networking if the ransomware interferes with normal operation. Restart Windows, enter Safe Mode from the recovery/startup options, and run the anti-malware scan from there so the malicious process is not active during cleanup.
3. Clean affected browsers in case secondary adware or redirects were installed alongside the payload:
- Chrome: Settings > Reset settings > "Restore settings to their original defaults," and remove unknown extensions under Extensions.
- Firefox: Help > More troubleshooting information > "Refresh Firefox," and remove suspicious add-ons under Add-ons and themes.
- Edge: Settings > Reset settings > "Restore settings to their default values," and remove unknown extensions.
- Android: Boot into Safe Mode, uninstall recently added or unknown apps in Settings > Apps, and clear the browser's cache and site data.
4. Manual and post-removal steps. After the scanner finishes, review Task Scheduler, the Startup folder, and autorun registry keys for leftover entries, and delete any confirmed malicious files identified by the hashes above. Apply all pending Windows updates, including MS17-010, and patch SMBv1 exposure. Finally, change passwords from a clean device and restore encrypted files only from known-good offline backups, since paying the ransom is discouraged and offers no guarantee of recovery.
Conclusion
Wana Decrypt0r.O Ransomware is a detection for a member of the infamous WannaCry / WanaCrypt0r ransomware lineage, a family remembered for its worm-driven 2017 global outbreak and its aggressive file encryption. The analyzed sample confirms the profile that makes this class so dangerous: a UPX-packed, unsigned x86 binary with anti-debugging defenses and heavy user-data access that modified hundreds of files in a single run. Users should keep Windows fully patched, maintain offline backups, and run a reputable anti-malware tool such as SpyHunter to detect and remove this threat before it can encrypt valuable data.
Analysis Report
General information
| Family Name: | Wana Decrypt0r.O Ransomware |
|---|---|
| Packers: | UPX |
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
0eb9aebb7a081182975e980f2c726b72
SHA1:
d636fb13907769e2e0e6b642a24c3316ad50fdfb
SHA256:
1F080B026DC6B23E1AB082D21B4F8F15A1DD2F07A70CD949033F1D12B2430508
File Size:
9.32 MB, 9317888 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | Mobatek |
| File Description | MobaXVT |
| File Version | 1.02 |
| Internal Name | MobaXVT |
| Legal Copyright | Mobatek |
| Legal Trademarks | Mobatek |
| Original Filename | MobaXVT |
| Product Name | MobaXVT |
| Product Version | 1.02 |
File Traits
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 138,943 |
|---|---|
| Potentially Malicious Blocks: | 21,600 |
| Whitelisted Blocks: | 58,031 |
| Unknown Blocks: | 59,312 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\ascii.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\ash.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\awk.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\basename.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\bash.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\bc.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\bzip2.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cat.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\chgrp.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\chmod.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\chown.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\chroot.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\clear.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cp.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cpio.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\crypt.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cut.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygcrypto-0.9.8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygexpat-0.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygfontconfig-1.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygfreetype-6.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygiconv-2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygintl-3.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygintl-8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygminires.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygncurses-8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygpath.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygpopt-0.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygreadline6.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygssl-0.9.8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygwin1.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\cygz.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\d2u.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\date.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\dd.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\df.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\dir.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\dirname.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\dmidecode.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\du.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\echo.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\ed.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\editrights.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\env.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\expand.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\find.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\ftp.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\getopt.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\grep.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\gzip.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\hdparm.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\head.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\help | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\hostname.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\id.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\kill.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\less.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\ln.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\locate.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\ls.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\md5sum.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mkdir.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mkgroup.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mkpasswd.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mkshortcut.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mobahwinfo | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mobakilltask | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mobaswinfo | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mobatasklist | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mobavt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\mv.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\nice.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\passwd.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\ps.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\pwd.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\rcp.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\realpath.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\rebase.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\regtool.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\rlogin.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\rm.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\rmdir.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\rsh.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\scp.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\sed.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\seq.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\sftp.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\shutdown.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\sleep.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\sort.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\ssh.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\strace.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\sum.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\sync.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\tail.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\talk.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\tar.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\tcpcapture.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\telnet.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\tftp.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\time.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\top.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\touch.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\tput.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\tr.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\uname.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\vim.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\vmstat.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\wc.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\wget.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\which.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\bin\who.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\20-fix-globaladvance.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\20-lohit-gujarati.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\20-unhint-small-vera.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\30-amt-aliases.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\30-urw-aliases.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\40-generic.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\49-sansserif.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\50-user.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\51-local.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\60-latin.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\65-fonts-persian.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\65-nonlatin.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\69-unifont.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\80-delicious.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\conf.d\90-synthetic.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\fonts.conf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\fonts\fonts.dtd | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\rebaseall | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\ssh_config | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\termcap | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat.dir | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\accessx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\basic | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\complete | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\default | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\iso9995 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\japan | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\keypad | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\ledcaps | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\lednum | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\ledscroll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\misc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\mousekeys | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\norepeat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\pc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\pc98 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\xfree86 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\compat\xtest | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry.dir | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\amiga | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\ataritt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\chicony | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\dell | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\digital\lk | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\digital\pc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\digital\unix | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\everex | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\fujitsu | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\hp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\ibm\thinkpad | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\keytronic | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\kinesis | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\macintosh | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\microsoft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\nec | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\northgate | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\pc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\sgi\indigo | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\sgi\indy | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\sgi\o2 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\sony | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\sun | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\geometry\winbook | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes.dir | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\aliases | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\amiga | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\ataritt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\digital\lk | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\digital\pc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\fujitsu | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\hp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\ibm | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\macintosh | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\powerpcps2 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\sgi\indigo | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\sgi\indy | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\sgi\iris | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\sony | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\sun | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\xfree86 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keycodes\xfree98 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keymap.dir | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keymap\amiga | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keymap\ataritt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keymap\digital\us | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keymap\macintosh | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keymap\sgi\be | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\qbvjqusp_mobaxvt\etc\x11\xkb\keymap\sgi\bg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
432 additional files are not displayed above.
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
