General
-
Target
9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample
-
Size
123KB
-
Sample
210528-aztjgyg22a
-
MD5
14de196b28bc12b5e571ea8303668041
-
SHA1
7f400d518bd716e75c795de47e1dc67f9d29d582
-
SHA256
9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b
-
SHA512
1fe6f312057ca6debe2552f02c231cacff60f79fc40c053c26500f58fe4575fd4c820883bb4203ead2e9db00402883389d72853f304d3e198a333ef49e387b6f
Static task
static1
Behavioral task
behavioral1
Sample
9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe
Resource
win10v20210410
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
prometheus
http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
prometheus
http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
prometheus
http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
prometheus
http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD
Targets
-
-
Target
9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample
-
Size
123KB
-
MD5
14de196b28bc12b5e571ea8303668041
-
SHA1
7f400d518bd716e75c795de47e1dc67f9d29d582
-
SHA256
9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b
-
SHA512
1fe6f312057ca6debe2552f02c231cacff60f79fc40c053c26500f58fe4575fd4c820883bb4203ead2e9db00402883389d72853f304d3e198a333ef49e387b6f
Score10/10-
Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
-
Modifies Windows Firewall
-
Deletes itself
-
Drops startup file
-
Modifies file permissions
-
Modifies WinLogon
-