BlackRuby Ransomware

VTI SCORE: 100/100

Target:

win7_32_sp1 | exe

Classification:

Dropper, Downloader, Ransomware

daea4b5ea119786d996f33895996396892fa0bdbb8f9e9fcc184a89d0d0cb85e (SHA256)

Defender.exe

Windows Exe (x86-32)

Created at 2018-02-08 14:58:00

Notifications (1/1)

The operating system was rebooted during the analysis.

Connection Overview

Contacted Hosts (1)

Hostname	IP Address	Location	Protocols	Reputation Status	WHOIS Data
freegeoip.net	104.31.11.172, 104.31.10.172	United States	HTTP, DNS, TCP	Unknown	Not Queried

Contacted URLs (1)

URL	Categories	Names	HTTP Status Code	Reputation Status
freegeoip.net/json/	-	-	HTTP_STATUS_OK (200)	Unknown

Connections

DNS (1)

Operation	Additional Information	Success	Count	Logfile
Resolve Name	host = freegeoip.net, address_out = 104.31.11.172, 104.31.10.172		1	Fn

HTTP Sessions (1)

Information	Value
Total Data Sent	0.07 KB
Total Data Received	0.65 KB
Contacted Host Count	1
Contacted Hosts	freegeoip.net

HTTP Session #1

Information	Value
Server Name	freegeoip.net
Server Port	80
Data Sent	0.07 KB
Data Received	0.65 KB

Operation	Additional Information	Count	Logfile
Open Session	access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS	1	Fn
Open Connection	protocol = http, server_name = freegeoip.net, server_port = 80	1	Fn
Open HTTP Request	http_verb = GET, http_version = HTTP/1.1, target_resource = /json/	1	Fn
Send HTTP Request	headers = host: freegeoip.net, connection: Keep-Alive, url = freegeoip.net/json/	1	Fn Data
Read Response	size = 4096, size_out = 664	1	Fn Data

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Notifications (1/1)

Connection Overview

Connections

WHOIS Domain Information

Before

After