venus | fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe
Size 225KB
Sample221222-fgclwadh53
SHA256 fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3
MD5 f62590e838b1d13960abb6b363e03ed9
SHA1 66f706a7d39038964471e0a009a76e0f978fb075
SHA512 7d372043b31cca8d6d73ecd386e08d720ec29fa02e6c01b099c70977e7bdbd06f2a2a8c44f1b813c1a4b67b12a37a51efcfc3776e8667ed216b25d2bf1d56556
SSDEEP 6144:IuC7JmXiQwAh6jkJwkNV50DEr9MxgTw7ozFD254W:IuCteiQwAjw1DDGcopfW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

venus

Malware Config

Signatures

Venus Ransomware 1 IoCs

resource	yara_rule
sample	family_venus

Venus family
venus

File Explorer

fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe

.exe 225KB

fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe

IMPHASH bb2600e94092da119ee6acbbd047be43
SHA256 fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3
MD5 f62590e838b1d13960abb6b363e03ed9
SHA1 66f706a7d39038964471e0a009a76e0f978fb075
SHA512 7d372043b31cca8d6d73ecd386e08d720ec29fa02e6c01b099c70977e7bdbd06f2a2a8c44f1b813c1a4b67b12a37a51efcfc3776e8667ed216b25d2bf1d56556
SSDEEP 6144:IuC7JmXiQwAh6jkJwkNV50DEr9MxgTw7ozFD254W:IuCteiQwAjw1DDGcopfW
MD5 SHA1 SHA512 SSDEEP

windows x86

Venus Ransomware

Minor OS version

Major OS version

Entry point

22912

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

crypt32

CryptStringToBinaryA

comctl32

ord17 InitCommonControlsEx

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum

kernel32

Process32FirstW GetSystemInfo GetVersionExW GetModuleHandleA lstrcpyA GetProcAddress ExitProcess GetModuleHandleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetVolumeInformationW GetVolumePathNameW MulDiv GetCommandLineW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetFileSize QueryDosDeviceW ReadFile GetTempPathW CreateMutexW CreateProcessA lstrcatA IsWow64Process GetModuleFileNameA GetModuleFileNameW SetVolumeMountPointW Process32NextW ResumeThread WaitForMultipleObjects GetComputerNameExW lstrcmpiW GetSystemTime GetWindowsDirectoryW lstrcatW GetLastError Sleep GetCurrentThreadId CreateFileW lstrlenA WriteFile lstrlenW lstrcpyW CreateThread GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceW lstrcmpW GetProcessHeap CloseHandle HeapReAlloc OpenProcess Wow64DisableWow64FsRedirection WaitForSingleObject GetCurrentProcess VirtualAlloc

user32

DefWindowProcW GetWindowRect GetDC SetWindowPos MessageBoxW CreateWindowExW SendMessageW EndDialog GetSystemMetrics RegisterClassExW wsprintfA DispatchMessageW SetTimer RegisterHotKey TranslateMessage LoadCursorW GetClientRect GetDlgItem PostQuitMessage wsprintfW DrawTextW GetMessageW ReleaseDC SystemParametersInfoW ShowWindow LoadImageW

gdi32

CreateCompatibleBitmap BitBlt CreateFontW DeleteDC GetDeviceCaps SetBkMode SetTextColor DeleteObject GetTextExtentPoint32W SelectObject CreateCompatibleDC CreateDIBSection SetBkColor

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW SystemFunction036 RegQueryValueExW RegQueryValueExA RegCloseKey AllocateAndInitializeSid

shell32

SHGetPathFromIDListW CommandLineToArgvW ShellExecuteExW SHBrowseForFolderW SHEmptyRecycleBinW

ws2_32

ntohl inet_ntoa setsockopt socket gethostbyname WSAStartup inet_addr htons bind WSACleanup sendto

iphlpapi

SendARP GetAdaptersAddresses

netapi32

NetApiBufferFree NetShareEnum