General
-
Target
new bomani.exe
-
Size
78KB
-
Sample
220330-ky7kssbab7
-
MD5
1a75e7dd18a7186ca44fcf27eb94c4aa
-
SHA1
049917bb6e78a990f753119e36015c540d51d28f
-
SHA256
bbad11dfe76b92735648bce03bc5e163e235120d1114391be78665f8c2f14c94
-
SHA512
8fc7ec6637279dab404cba57c913bfa095de487b2217e7aab9d8653644649e5a2c50882f9ee825f4b0403b45257114d6e6e65e6f2f2e947aa7e00b762ebaa258
Static task
static1
Behavioral task
behavioral1
Sample
new bomani.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
new bomani.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
new bomani.exe
-
Size
78KB
-
MD5
1a75e7dd18a7186ca44fcf27eb94c4aa
-
SHA1
049917bb6e78a990f753119e36015c540d51d28f
-
SHA256
bbad11dfe76b92735648bce03bc5e163e235120d1114391be78665f8c2f14c94
-
SHA512
8fc7ec6637279dab404cba57c913bfa095de487b2217e7aab9d8653644649e5a2c50882f9ee825f4b0403b45257114d6e6e65e6f2f2e947aa7e00b762ebaa258
Score9/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-