Overview

overview

10

Static

static

10

99bc5e8213...7f.exe

windows7-x64

10

99bc5e8213...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99bc5e82135557b8e571b2deab9f297f.bin

  • Size

    136KB

  • Sample

    221118-k4twwsch6x

  • MD5

    99bc5e82135557b8e571b2deab9f297f

  • SHA1

    ec11f6abf13044a438a7f363bda2c9d5709d2475

  • SHA256

    04d75593f6acdfe0c959345b8d6702166537d7533abfeb4b568339dee1986b5e

  • SHA512

    cffb151124a92bd9a1dca3e12ad4482e1dbdb4ff93099785e02b897c688d0a741a6d28b9ab40bc757e24caee1890ec207287058176547ff2bc48803c8aea7a5c

  • SSDEEP

    3072:d4YLjaoAN6vHt5pmX8Q8QAjD44vcTlYewhp8J1HGjqZfTd3zHZ0DELbT4n:tlmX8QHA0B9Sp+1cmV50DEr4n

Score
10/10
venuspersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      99bc5e82135557b8e571b2deab9f297f.bin

    • Size

      136KB

    • MD5

      99bc5e82135557b8e571b2deab9f297f

    • SHA1

      ec11f6abf13044a438a7f363bda2c9d5709d2475

    • SHA256

      04d75593f6acdfe0c959345b8d6702166537d7533abfeb4b568339dee1986b5e

    • SHA512

      cffb151124a92bd9a1dca3e12ad4482e1dbdb4ff93099785e02b897c688d0a741a6d28b9ab40bc757e24caee1890ec207287058176547ff2bc48803c8aea7a5c

    • SSDEEP

      3072:d4YLjaoAN6vHt5pmX8Q8QAjD44vcTlYewhp8J1HGjqZfTd3zHZ0DELbT4n:tlmX8QHA0B9Sp+1cmV50DEr4n

    Score
    10/10
    venuspersistenceransomwarespywarestealer

    • Venus

      Venus is a ransomware first seen in 2022.

      ransomwarevenus

    • Venus Ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks