2e2cef71bf99594b54e00d459480e1932e0230fb1cbee24700fbc2f5f631bf12

General

Target
2e2cef71bf99594b54e00d459480e1932e0230fb1cbee24700fbc2f5f631bf12.bin.exe
Size 225KB
Sample221016-y2pfaaabem
SHA256 2e2cef71bf99594b54e00d459480e1932e0230fb1cbee24700fbc2f5f631bf12
MD5 f5e72bf445387eddec000e0238adf873
SHA1 895eb3047e7a28ce219fdd7e7ad5ce2a61312d93
SHA512 d8667ebb53c14e2401b1fd805e4835dedddb3a5dadf75e097ca9fa3047009dfda96b60d82b17fd014e35a0f6a9ca2c294bbf21ee4a5fecf58029d80c5787fcc3
SSDEEP 6144:nRqMJmXIQwAPFoXJDc7V50DErD5xgTw7ozFz254W:nRq6eIQwAuDnDkGcoxfW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\README.html

Ransom Note

<html><head><title>Venus</title><style type = "text/css">*{padding:0;margin:0}p{color:white}.f{background-color:#ff7c00;width:100%;margin-left:auto;margin-right:auto;height:100%}.c h1{color:white;line-height:80px}.r{word-break:break-all;float:left;width:100%;text-align:center}</style></head><body><div class="f"><div class="c"><h1 align="center"><<<Venus>>></h1></div><div class="r"><p></br></br></br></br><strong>We downloaded and encrypted your data.</strong></br>Only we can decrypt your data.<br><strong>IMPORTANT!</strong><br> If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay.<br> In this case we will not be able to help you.<br>Do not play with files.</p><p>Do not rename encrypted files.<br>Do not try to decrypt your data using third party software, it may cause permanent data loss.<br>Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.</br>-----------------------------------------------------</br>Contact and send this file to us:<br><strong><br>[email protected]<br>[email protected]<br>jabber:[email protected]</strong><br><br>iQERSu9pIaqJ6AkkDuHDOStDdLeJdzXGheQJEjCIoCM0OYE/plN80FA3hjY12vBW OzoQrhda+UiMjD+qFEunNELsn6UgFDqh9bgUvdpnAP11+uLMCbhZ9BFJ60Qs59w8 rZpirfZB2bNVpfKdEBM313/kHyP+pR+YP+yTkexKAApUNRa4zYbgn90biTN0yee6 yGCqCEtsRJOppN93+Gqv6ywdo/MSs1ueJ5BLq2SCWdD/uTG09hJROzN2pzdrMzrg GyGAM5niHuWIscManKU0P0d0WXN7hUYmqwouBswYIEXuDc6vJXSFdFzAfeHfOkPK Sa8slenyIND2aXR4PkRCu+YeydlH30jnjEiP8zwTjEWxh4jM/waIAGKe545tvmvH L0nmrvGF4J3qD7jJluybq//p27BZZINmWUmsdZiDGDxAzeMW+Hlk9D5jSGCoMe2r 35yfXOlIbR1a0SlWnOi0yHzATDEhxUqm3/EDk/acmP2RJSc+jcalCSOmZz1k0OfC GHlKusy2NTDAZT2ig8TxTj8sMQZKm5B6fxVFyT4zRdRDbRol0qJM/73MLAHYneIx JgUvZ3oUPkTZDgGsagIhm/J0ImfBb3r/T09GLDZne0nLRECrLaO0auTPwYkHGkVY NbUJzis1rVRsGuzHevw= </p></div></body></html></html></body></html>

Emails

us:<br><strong><br>[email protected]<br>[email protected]<br>jabber:[email protected]</strong><br><br>iQERSu9pIaqJ6AkkDuHDOStDdLeJdzXGheQJEjCIoCM0OYE/plN80FA3hjY12vBW

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\7039922161972527219.hta

Ransom Note

<<<Venus>>> We downloaded and encrypted your data.Only we can decrypt your data.IMPORTANT! If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay. In this case we will not be able to help you. Do not play with files. Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.-----------------------------------------------------Contact and send this file to us: [email protected] [email protected] jabber:[email protected]

Emails

Targets

- Target
  2e2cef71bf99594b54e00d459480e1932e0230fb1cbee24700fbc2f5f631bf12.bin.exe
- Size 225KB
- SHA256 2e2cef71bf99594b54e00d459480e1932e0230fb1cbee24700fbc2f5f631bf12
- MD5 f5e72bf445387eddec000e0238adf873
- SHA1 895eb3047e7a28ce219fdd7e7ad5ce2a61312d93
- SHA512 d8667ebb53c14e2401b1fd805e4835dedddb3a5dadf75e097ca9fa3047009dfda96b60d82b17fd014e35a0f6a9ca2c294bbf21ee4a5fecf58029d80c5787fcc3
- SSDEEP 6144:nRqMJmXIQwAPFoXJDc7V50DErD5xgTw7ozFz254W:nRq6eIQwAuDnDkGcoxfW
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

persistence evasion ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2