General
-
Target
e657ff4838e474653b55367aa9d4a0641b35378e2e379ad0fdd1631b3b763ef0.bin
-
Size
1.8MB
-
Sample
220720-q4fl6agbbr
-
MD5
ab99a5767c1d598c49b1f5d615a76302
-
SHA1
b4061d4227e08cfaa3190dea9926571fca2736a1
-
SHA256
e657ff4838e474653b55367aa9d4a0641b35378e2e379ad0fdd1631b3b763ef0
-
SHA512
f12db9f7bfaa22747cc38a10a317bd6c7af483f9275f5981186d74435dda80df6faf53d10ee47c63b4b213310d29ca0eef5966983ecaa0dd7463a50c62cfab0c
Behavioral task
behavioral1
Sample
e657ff4838e474653b55367aa9d4a0641b35378e2e379ad0fdd1631b3b763ef0.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
e657ff4838e474653b55367aa9d4a0641b35378e2e379ad0fdd1631b3b763ef0.exe
Resource
win10v2004-20220718-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW-TO-DECRYPT-cm99v.txt
http://o76s3m7l5ogig4u5.onion
Extracted
C:\Users\Admin\Searches\HOW-TO-DECRYPT-cm99v.txt
http://o76s3m7l5ogig4u5.onion
Targets
-
-
Target
e657ff4838e474653b55367aa9d4a0641b35378e2e379ad0fdd1631b3b763ef0.bin
-
Size
1.8MB
-
MD5
ab99a5767c1d598c49b1f5d615a76302
-
SHA1
b4061d4227e08cfaa3190dea9926571fca2736a1
-
SHA256
e657ff4838e474653b55367aa9d4a0641b35378e2e379ad0fdd1631b3b763ef0
-
SHA512
f12db9f7bfaa22747cc38a10a317bd6c7af483f9275f5981186d74435dda80df6faf53d10ee47c63b4b213310d29ca0eef5966983ecaa0dd7463a50c62cfab0c
Score10/10-
Hades Ransomware
Ransomware family attributed to Evil Corp APT first seen in late 2020.
-
Hades payload
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Loads dropped DLL
-