General
-
Target
5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b
-
Size
281KB
-
Sample
220802-c8henaghfq
-
MD5
a0ad66bbe2af5c64af859ed1b250e145
-
SHA1
5a85f7fa7ed7b2c706b3bbfb8f42fba757420c0f
-
SHA256
5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b
-
SHA512
ab20e4f71c17dfea5b5ceb891add576d4de86da2c452ab2e754605c3ee47978a2d37b1780d2fabed44ddd8648b8b558f4273ae6eede316cddeabb668d01a8963
Static task
static1
Behavioral task
behavioral1
Sample
5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\Restore-My-Files.txt
http://decrmbgpvh6kvmti.onion/
http://helpinfh6vj47ift.onion/
Targets
-
-
Target
5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b
-
Size
281KB
-
MD5
a0ad66bbe2af5c64af859ed1b250e145
-
SHA1
5a85f7fa7ed7b2c706b3bbfb8f42fba757420c0f
-
SHA256
5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b
-
SHA512
ab20e4f71c17dfea5b5ceb891add576d4de86da2c452ab2e754605c3ee47978a2d37b1780d2fabed44ddd8648b8b558f4273ae6eede316cddeabb668d01a8963
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-