Comparing Ransomware using TLSH and @DisCo Analysis Frameworks
IEEE Big Data 2021 Cyber Threat Intelligence and Hunting with AI Workshop
Rafer Cooley, Michael Cutshaw, Shaya Wolf, Rita Foster, Jed Haile, Mike Borowczak,
Introduction
Multiple families of malware were compared together using fuzzy hashes and custom binary analysis programs.
List of hashes for malware samples used in paper:
5fa14751ef7fa7299d9ac8a13a45d50c91fc787e720ae661742a211861319972
a11cc5051e3a88428db495f6d8e4b6381a1cb3fa5946a525ef5c00bfcb44e210
d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6
508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add
83002399482a30115e37cea0222fdb265cc6d57101ca7ce4591374acd6b8a371
c9b04ec734151245774b54df09fc77011d703f4c93c277dbd26b998e7b6db29c
b47e281bfbeeb0758f8c625bed5c5a0d27ee8e0065ceeadd76b0010d226206f0
81878c4cd8c79fcc10478f15ea6d00a0d1151a205943eaf47e8c4cd450db0915
68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7
42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135
593bbcc8f34047da9960b8456094c0eaf69caaf16f1626b813484207df8bd8af
3b5e260a1db66a360c9e4c210fbccdb1aa197bffa4fd6344fff9ca9d21559566
665afa26d6110bb35ec8a60878068a0e69e1c805d9073bef71a48a3404c164e9
43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
0425f6cf8c9cc7c507e766119262f9c7c5c90baf9ef744d64f9f7b4fe526fb45
8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc
8005fd566349d5bde690c1f32e67dc3fbd9e195c63bf10ef05d51cfe040335f1
4270895e0d3973d98d5014e299f9e9a4dee0e528d37adbbcf47dc52ca483fd74
6081e88fe927e60d87da7a0bf1cc748f3c52f951a80dd3e4bd16ceaadc80571a
ae9e09a6b7706983206261a8f923d908b5523caa08c57995b1601581ac04be0e
d8a9879a99ac7b12e63e6bcae7f965fbf1b63d892a8649ab1d6b08ce711f7127
8edf732c9138a27c8bd12286450034e5b524b468a9bb6a36ccf3c4ab2c4302f5
9c7a33d57688c7a82516a378cf014acadf68e39d0b13063f75c108dc2a40587d
9b60c622546dc45cca64df935b71c26dcf4886d6fa811944dbc4e23db9335640
e98170984c87aa1b92df230ef020557cad5afa4cf6815f7cbd764a70a1323b66
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60
6bf1839a7e72a92a2bb18fbedf1873e4892b00ea4b122e48ae80fac5048db1a7
156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673
f4f73a451c1ec493eb3b4395d06de73598fcf5b8f7d13e81418238824d90fda3
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
1d4c0b32aea68056755daf70689699200ffa09688495ccd65a0907cade18bd2a
68a96bd0c150d2808755edfc90b2263626de612b4907e772af3bb552f0fcc4ca
07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd
7789ea5daa745b54c53ccc3ef91589e3583f1c80d0985d74717bcd2be22f859b
74320a6921912c89e7e2e0f44e1192926b226f5b70a580c0a36c6e1c8b8dd0fe
8c32012baa74c8ee1bf676094f688505eae215317cc38c0e28a518e5a9d0b70b
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
66060484cccedb839fb646d4e6020e079319374b2847c52dcec55c5ad60b1beb
b6855793aebdd821a7f368585335cb132a043d30cb1f8dccceb5d2127ed4b9a4
6ed3e4d85b44330f9e8254aec9b0055cbc51438472b366dd653201abf452bb89
2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c
17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483
5ad4efd90dcde01d26cc6f32f7ce3ce0b4d4951d4b94a19aa097341aff2acaec
7e70460a2e395485fe6328a58e09400fc7963afeb29fdadb924c340e758b267c
9cc3c217e3790f3247a0c0d3d18d6917701571a8526159e942d0fffb848acffb
81b452c5cfc9b054231b73c412e06335770965ec8ec92a309df18c1909233a70
e8450dd6f908b23c9cbd6011fe3d940b24c0420a208d6924e2d920f92c894a96
a3412b72b53e761867623cbb41acfc2b48fd7372f4b7f387047ca82dbc387de3
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93
e453400f413b4ad2e996c28b7e72be2d42fc2a8d30e9c91a67a0e0e6915aff7f
d2ea89e73804efccefceaa193c80ef4a8454f7db638c0d3502530652a8a430e9
b3c39aeb14425f137b5bd0fd7654f1d6a45c0e8518ef7e209ad63d8dc6d0bac7
c16fc61415f537f42b9d813cd9538898f53865e1f5b46f25db2ab26bad2dffd2
521c503bc3f5d8b2aa8819e8e30e2019e74ea9649a57529fb32c3dfc66a1e7ef
bc32a2ccf158ebe2b76646be865a4c6dd91da6b8e5bb0dd9520102a9bfea5439
8931fa8e5b8ec0db4b1a722778eaaf580ed1a45fc4f93a5e879d688925971424
454fe83bd5a26429ea01b37105bd41718f97359933d272799309ccc6fbcdcb7c
ed492db95034ca288dd52df88e3ce3ec7b146ffd854a394ac187f0553ef966d9
c93e6237abf041bc2530ccb510dd016ef1cc6847d43bf023351dce2a96fdc33b
533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d
61ca175c2f04cb5279f8507e69385577cf04e4e896a01d0b5357746a241c7846
c1f1bc58456cff7413d7234e348d47a8acfdc9d019ae7a4aba1afc1b3ed55ffa
bc81f86bdc1b3a0a3229b88981c62ccdc754f90d0760405991896ad2f21a7c2a
e12e9ff0a4cf29714bed618d69ff121b8a8d269d741cc1dbc8d92b9a405716a0
da3bb9669fb983ad8d2ffc01aab9d56198bd9cedf2cc4387f19f4604a070a9b5
a3c1eef5c74d63d45b6baae42fb808bf52d6198550304e508eaaa77b584a1d9e
ec368752c2cf3b23efbfa5705f9e582fc9d6766435a7b8eea8ef045082c6fbce
7c465ea7bcccf4f94147add808f24629644be11c0ba4823f16e8c19e0090f0ff
ac092962654b46a670b030026d07f5b8161cecd2abd6eece52b7892965aa521b
2d73ce9f8e11bbbce1bec1147bf30ef60a6d362504fbf650b3c8a0ea6f7c4fbb
86249470665edd52f64c2261389c00b001789cd83fcf412c36ef842ce434703e
afb22b1ff281c085b60052831ead0a0ed300fac0160f87851dacc67d4e158178
6e57810c41f253c8725d738cc83e703c1defaa1c2477314165d12bfd81e23417
e4569dcd012ebfd64f7a33b77f385edab89d21ea44b96488e4fd63b3893d7b4c
6d656f110246990d10fe0b0132704b1323859d4003f2b1d5d03f665c710b8fd3
2d82be244e23001148ed5a6d83856b6f7cd20c3f7786481303d5d584c51ff5f0
6295da1218817aaac71447d83d2221d251724dd33751d94581e3f10e76da1280
93c4b144a4ef5e9ebcb5de425f6151fb6fd892d1042b21e639ab6c358cad3940
602375762d88d24ae659c47d25959e52ed5cea1d227609ec486bd42d551ca009
16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab
984ce69083f2865ce90b48569291982e786980aeef83345953276adfcbbeece8
cbbc7052fed8d0002d07736a68219f01a5a4e1c19ee50310e2381e96fa8836ed
0466c30d11752dc81e27fd20d12ba53b418ee88fc4fed4e1a1b41a2016ede294
bfbe9826927232ab355f0dc6343175dec5244026bdead1ca7033f4ba62d9a65c
5219bdf17e6cf7552c564701ac7b2ceb46ee165840d9cf22c1291fa43ca4d56f
1fb2178279b76d9ed5e3c24b24885a31ec521e58a4688597600d26f88df5b8e1
a0eca3f1e6797ebb44ece1478362781f5161e74314845571e91ba97e43571f7d
a6cb88a93bf6e53517d871f6055ca962422a5b4c3c0b7441018270748fa6590a
b8fcf275ea5024bc10bd51f4db8f59d01822b9ec61e7a5ada8bf6290954933b2
52612bceee07152f2e2e6699b3c085149e11979f34fe248bda14e03a0d950e85
b66db13d17ae8bcaf586180e3dcd1e2e0a084b6bc987ac829bbff18c3be7f8b4
4589a8d0716595f43499858fe3603a4114f6cf34b1cfc50b73ff56d88450c688
ad4f00ab519845f4c1a3a4044e9d7992dc37c5887c08260282f9731f21c5da99
1bc9040cfa3738e8a2e0409efb17726c8f4894e462f2e51d2a18664c4c799e16
e3e37c5cf4b43ea92fd71e08edc38bcfe6fe33f283f62aa5632113c444a71b00
47eccaaa672667a9cea23e24fd702f7b3a45cbf8585403586be474585fd80243
f74c7a605588db80b0812de54ae0f5bf26fcaef8e7dce830a64cbeaddbac7673
75175009b6864cf3a0147051272ccf63d8fac7f7a521e32f9d3c69a7acd4866d
892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f
12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65
11d0f63c06263f50b972287b4bbd1abe0089bc993f73d75768b6b41e3d6f6d49
2dcac9f48c3989619e0abd200beaae901852f751c239006886ac3ec56d89e3ef
78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134
3c4063956b797106cc43a49a634bb530aecd6e9a898124bb8fed6978f4556ee0
710842ac4a3eacd2f26e63be0922b15c9be825a2dc4f047961361b59bc6431fc
93bd21cb6331ce96cc28dc7a1f0b6b2b2ed8ec064d2ac6e1f428af59c924cb57
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec
7dbf54a7d28bc41c266a9277238b7ca8089e0df97b0c917f3424a443185f99c5
f67864421d6271aa65d39cb68bb836d2838c681aedade4c77ca198d3e78c70fb
2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
e51e4c372edf2bbe476a4b7630225c1875c5ccea2ed55b418bd793c54ce9a84d
9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879
fb76b4a667c6d790c39fcc93a3aac8cd2a224f0eb9ece4ecfd7825f606c2a8b6
fd8ba926720610c0864ed8f53bfe61b9d991883798f176f7ad65a16102aeeca3
75fafe3d3519a16ec537108780cab1d2c3f37bc297b494f49ebf544f3f356f72
151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5
c365ddaa345cfcaff3d629505572a484cff5221933d68e4a52130b8bb7badaf9
09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa
1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb
3ba4483c761a05e590671f54a39032630f82820177bbe7fcee9c445f6d5fd6db
ae9e7267039039c83022e9991d04e9010f4d987826b0fa09eaffaad599c54ee0
c2a96c37b4beef66ee7b650c9043d693a1d939527aed13c58f6b1706b8d016e0
c068e2fe99d491ce2dc1db43bcad040038be3f9b30c67b779c4f5c8f3e710312
938e0e4868f00c4cda6f6b70542e6eb0d04982b706cd4eb5a4becb7c2da1fd3f
b9f3199637a3662429d829e2eb2d210fc96bf282883e721da1704981c136b143
735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
d43b271fb4931263f8fa54b297e3cf60762a0fe5c50ed76999f276dcc3c283be
e14f1a655d54254d06d51cd23a2fa57b6ffdf371cf6b828ee483b1b1d6d21079
24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95
e2a33fede9a1d897e504541f61bf7ded193e801dda952657d615f34d6b94cdd3
d10b2371ee70189abe37e8f0779ce3ecca51fd896cdda991289dfe14eaae1a76
016b9f1c52a6eff5ec77deb7efbf2265a9d4fe0508510e6bf241098b29dbaa25
4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982
b7e327f63639270c1c5d56b51a5cef6e2541687ff310f5bc79cf5d80d822194f
d4fdf1950183893b509bea00c233ae5d54b87bdd57a0b90aa6bf27181ab108d4
bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893
0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9
56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a
f8812f1deb8001f3b7672b6fc85640ecb123bc2304b563728e6235ccbe782d85
029c5d48e425206e2ae84a63d62bdbc80362702913b38618a423c541c8a0ed40
2e050601b908a29f8c0d113abdb0ed867d6c310b2bb58bf3ce607a9f33338a55
8d49c283fa8ca2972aa06c3652da6739965900caf47c0d630305f9d0f3fe6396
cc54647e8c3fe7b701d78a6fa072c52641ac11d395a6d2ffaf05f38f53112556
b8dc282b15526821326ae7158f5e4e895a874fc15499d102d59e819aa78d5800
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
ce19e4ed0385850a51c60558b2f38fad20196cdeaae3767ffb92e8dd2508a88b
1be0b96d502c268cb40da97a16952d89674a9329cb60bac81a96e01cf7356830
6e5f225b72d932fa68cafd3e0366298d5b1b92098049dcf01f6e3f2ad0f9b92e
429b96b0c9a715d0d7735ed12cec95b5183cd398f7291546478cb7ac12451df6
108e8f5a4051763f052d008fb1dc3a9fbc56d149b3bf442fc06a4a35178efe03
973dfafc3051d8c2849f62c556ab8057da706f15d1ffd8871de894ae3a24d86b
e0493b082077648eb33ca1294f2b26bc4c96d3820913c46330923e8bb3d73230
bec5d4b9979a2094fe1062512ea2754b9ce573b879b25167fa8a4f52f350edc9
e0ae340425fbb9afd4a463345d1fb470bd81110c4ae6a89f1727a8307a4070db
12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39
5a9c0945beff64f70dd87931c2537f87e9b6b975c9a936be9832323c0ddc473c
1ef8db7e8bd3aaba8b1cef96cd52fde587871571b1719c5d40f9a9c98dd26f84
Bibtex Citation: