General
-
Target
20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin
-
Size
222KB
-
Sample
210528-43bj78bba6
-
MD5
1493deb48d84805f19ba35e60d485e87
-
SHA1
a34a1aeda6019b041f112b1ddbbc290ef523042b
-
SHA256
20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5
-
SHA512
ce83d28d70a0d3f108431aa31858030a2cfb91d77f470fd7ef4aecbcd213541f4e393e2d59cdad1d2578dbd3411f43be9c1612e2a63dab8560bc64a16bb589ef
Static task
static1
Behavioral task
behavioral1
Sample
20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
prometheus
http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
prometheus
http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
prometheus
http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD
Targets
-
-
Target
20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin
-
Size
222KB
-
MD5
1493deb48d84805f19ba35e60d485e87
-
SHA1
a34a1aeda6019b041f112b1ddbbc290ef523042b
-
SHA256
20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5
-
SHA512
ce83d28d70a0d3f108431aa31858030a2cfb91d77f470fd7ef4aecbcd213541f4e393e2d59cdad1d2578dbd3411f43be9c1612e2a63dab8560bc64a16bb589ef
Score10/10-
Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Modifies file permissions
-
Modifies WinLogon
-