General
-
Target
6104195775758336.zip
-
Size
2.0MB
-
Sample
220328-vcan2sgdgk
-
MD5
0142ba07daaaaced3c499d1a6393c8c9
-
SHA1
59d36c90c01195068ffd362fe2fedd5f45fb7d6d
-
SHA256
5162a9211b246b3c4c16958d54ddbc6728200c71839d8550112a92cf34ceacd8
-
SHA512
921c4f6998d0c80ca15aca44e5f5cb2b5eb016bd0906f89d0ba3167ca952334602e756ccc73e7f440c2de30801008fa157535fe9c50c0adf4fc5a95f1b8d9170
Static task
static1
Behavioral task
behavioral1
Sample
8a30d72bb314ae7eab1952c7bef22a34147680166cf451c5d5843179fadfa154.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
8a30d72bb314ae7eab1952c7bef22a34147680166cf451c5d5843179fadfa154.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\1976_391151377\english_wikipedia.txt
prometheus
https
http
Targets
-
-
Target
8a30d72bb314ae7eab1952c7bef22a34147680166cf451c5d5843179fadfa154
-
Size
3.8MB
-
MD5
df4c9dab5aaa330b8c9f17f051ef83cf
-
SHA1
3f7e67a1f32c90487a8a29ad74c315c62bda50ec
-
SHA256
8a30d72bb314ae7eab1952c7bef22a34147680166cf451c5d5843179fadfa154
-
SHA512
7636d5ea3264bd6269cd48904c06d286a3c4b513262db0b1ae8dcfa35aca47b899d5e3cc2a8d6a8bddf73759273d7a684f4b2e69807a5de91298c948396aa8c7
Score10/10-
Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-