Overview

overview

10

Static

static

0a4e583284...in.exe

windows7-x64

8

0a4e583284...in.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0a4e5832841ffff9f8d27ce8216d655c8743b682fff0f90dee6bd3ea83dec028.bin.exe
  • Size 225KB
  • Sample221016-y2pfaaabd6
  • SHA256 0a4e5832841ffff9f8d27ce8216d655c8743b682fff0f90dee6bd3ea83dec028
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\README.html

Ransom Note
  • <html><head><title>Venus</title><style type = "text/css">*{padding:0;margin:0}p{color:white}.f{background-color:#ff7c00;width:100%;margin-left:auto;margin-right:auto;height:100%}.c h1{color:white;line-height:80px}.r{word-break:break-all;float:left;width:100%;text-align:center}</style></head><body><div class="f"><div class="c"><h1 align="center">&lt;&lt;&lt;Venus&gt;&gt;&gt;</h1></div><div class="r"><p></br></br></br></br><strong>We downloaded and encrypted your data.</strong></br>Only we can decrypt your data.<br><strong>IMPORTANT!</strong><br> If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay.<br> In this case we will not be able to help you.<br>Do not play with files.</p><p>Do not rename encrypted files.<br>Do not try to decrypt your data using third party software, it may cause permanent data loss.<br>Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.</br>-----------------------------------------------------</br>Contact and send this file to us:<br><strong><br>email:[email protected]<br>tox:9DA3D60F51FB83B539BA0CC79B6D4BE83003F8E7A294B531B6EA05102486855ADEEFFF5A90C8<br>jabber:[email protected]</strong><br><br>VqTOo7BkbnnyExBTJ6d7ag5BWKscBfidaw/t+TKjMQUw6cTEA6GxnE/SCr6jUZ/y 4V5a+kIL/MmFbaj+fRNnDb/iLvXfq7NQNhK1qYiJWF9uHWCzaECD2jz5ND3afo3S cs9PW4FIyes1qB1UmgZKGehJrWkVtodSlNZ1sB25FktYlg9gkMbTroZmmzb8fTNv Nxx2YN7Wabwg7ofQlueKReMp+TB7BfaEruXjcx79cYr3eT7C+uvpGm0EuuvXbawZ 6DDeT5kqxFvogfW8FrzcfVh9SgGIeyWojE5y+9oSJIHmAta/fN/kTQ/F2QP1mFwl BLlq/3k+xiKkC7peSkZ0Lx8bgEkj2ADw44KsREvCUZ9sCsZcfwNqR3qadacCZT7b 6eSeNI06B1V4+dzsQKBKddDN3QMU/Dzaq2B+4J5b9l4edT/sn0cb6pbJU4DDIno8 9OvLVqL+R4CCGOjMYVy40bGCEBy2hJAM6WuDRAXItG834jr58c5uM0wUMeY3Fxib K0QIGG8gCe0KYy2FRcUHwDjVWFT+YtIZ4oLv2CQ4k0tCLoTi2uHRlhCVb88hW3gz AXVLuGD4ZKGWjYbr8A8HOSK40RGnBTYkYOpAWuNlGVb1I5J+aLwVWURkWozBp/pY xYh8osKteGIVhlRolQ== </p></div></body></html></html></body></html>
Emails

  • us:<br><strong><br>email:[email protected]<br>tox:9DA3D60F51FB83B539BA0CC79B6D4BE83003F8E7A294B531B6EA05102486855ADEEFFF5A90C8<br>jabber:[email protected]</strong><br><br>VqTOo7BkbnnyExBTJ6d7ag5BWKscBfidaw/t+TKjMQUw6cTEA6GxnE/SCr6jUZ/y

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\31781995021972527219.hta

Ransom Note
  • <<<Venus>>> We downloaded and encrypted your data.Only we can decrypt your data.IMPORTANT! If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay. In this case we will not be able to help you. Do not play with files. Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.-----------------------------------------------------Contact and send this file to us: email:[email protected] tox:9DA3D60F51FB83B539BA0CC79B6D4BE83003F8E7A294B531B6EA05102486855ADEEFFF5A90C8 jabber:[email protected]
Emails

Targets

    • Target
      0a4e5832841ffff9f8d27ce8216d655c8743b682fff0f90dee6bd3ea83dec028.bin.exe
    • Size 225KB
    • SHA256 0a4e5832841ffff9f8d27ce8216d655c8743b682fff0f90dee6bd3ea83dec028
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    persistenceevasionransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks