venus

General

Target

931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224 (1)
Size

225KB
Sample

221223-bfnwasfe88
MD5

e75c4033f31862d8e71afe87620e2cce
SHA1

ff5095b2501fd9beee4fbe0f2a17a3151b540476
SHA256

931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224
SHA512

00210ec5079aa9adbe594b009ec0f6f866295fb4191dc55c4214cb876e88bfc81aa41701dfa7c7b4964363fded98d78d1b0361b78c62a80bea07dad52f7ce5f0
SSDEEP

6144:xQJmXLQwAhWUkJ0kfV50DErCMxgTw7ozFD254W:xeeLQwAi07DKGcopfW

Score

10^/10

Malware Config

Extracted

Path

C:\README.html

Ransom Note

<html><head><title>Venus</title><style type = "text/css">*{padding:0;margin:0}p{color:white}.f{background-color:#ff7c00;width:100%;margin-left:auto;margin-right:auto;height:100%}.c h1{color:white;line-height:80px}.r{word-break:break-all;float:left;width:100%;text-align:center}</style></head><body><div class="f"><div class="c"><h1 align="center"><<<Venus>>></h1></div><div class="r"><p></br></br></br></br><strong>We downloaded and encrypted your data.</strong></br>Only we can decrypt your data.<br><strong>IMPORTANT!</strong><br> If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay.<br> In this case we will not be able to help you.<br>Do not play with files.</p><p>Do not rename encrypted files.<br>Do not try to decrypt your data using third party software, it may cause permanent data loss.<br>Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.</br>-----------------------------------------------------</br>Contact and send this file to us:<br><strong><br>email:[email protected]<br>email:[email protected]<br></strong><br><br>9C6K/FYOguQq6RjqcEyb3TDkZQg/REByD7yqlxZA8A3qtR+7lBBBsFHvxWtafTJ2 fkJ/vQoCZoHmZQnMont6aBZi6uaknXAlhgZdV0c/rWmjGeSIxby+sclTigydtojw CGa7SkZpqLnKSA/7QLKoIRUeCVihr3x+nkIFM4YS99sZIdgpynJcE466DXdoyxlK HK8oOCe2cAwBmsEvtcGo8abo3gMNKDx4TrBuTLQrCJw2HdiSWzdnVQLE/5gTO7ot A2IQdNtMgO+N0a8o63XQN1IEMy0lu9ddYw5//ZEVrcjMNt0HLicRB5mIHNEszDQ2 53LA2BdVI/U+6bRqjgaE5O9Wy37dxrzeda+ZuTPx/zK+mcPrtYZyeYO8pE6eHeLX jB3sZVeFG9BqFTuh9MAmqcjQnDyXISwP9DKjyEAK+qCetj8GDJobkNBEN4Kddjam 6rKpjnW0VQ4qxF4vBq/L7EeCQeiXl9+zC/GCwn9dyoNg0oqRADTJqCCBRWxRYE2p B9ey5DnMJ+reKmz+F5tzlnfLiCcOTUVbysEkBNDtq2YpmbTs3uCXjKi0wjo9uHDs p7cxKuMMUdKDTAHjXcSykOP3jSDFS89PwcmNkS6RewvFS8I/w0MJZ+ECgFZG9rPn /W57eeqKsg== </p></div></body></html></html></body></html>

Emails

us:<br><strong><br>email:[email protected]<br>email:[email protected]<br></strong><br><br>9C6K/FYOguQq6RjqcEyb3TDkZQg/REByD7yqlxZA8A3qtR+7lBBBsFHvxWtafTJ2

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\2015343831972527219.hta

Ransom Note

<<<Venus>>> We downloaded and encrypted your data.Only we can decrypt your data.IMPORTANT! If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay. In this case we will not be able to help you. Do not play with files. Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.-----------------------------------------------------Contact and send this file to us: email:[email protected] email:[email protected]

Emails

email:[email protected]

Targets

- Target
  
  931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224 (1)
- Size
  
  225KB
- MD5
  
  e75c4033f31862d8e71afe87620e2cce
- SHA1
  
  ff5095b2501fd9beee4fbe0f2a17a3151b540476
- SHA256
  
  931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224
- SHA512
  
  00210ec5079aa9adbe594b009ec0f6f866295fb4191dc55c4214cb876e88bfc81aa41701dfa7c7b4964363fded98d78d1b0361b78c62a80bea07dad52f7ce5f0
- SSDEEP
  
  6144:xQJmXLQwAhWUkJ0kfV50DErCMxgTw7ozFD254W:xeeLQwAi07DKGcopfW
Score

10^/10

venus evasion persistence ransomware spyware stealer
- Venus
  Venus is a ransomware first seen in 2022.
  ransomware venus
- Venus Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2