venus | Venus[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Venus.exe
Size 225KB
Sample230130-t9cdgabb67
SHA256 4f92e2f752e4b0b30193d53375cd2fbd4beff02db9d6b3b6cadbf3b50e503498
MD5 07f5fbcb96179acffab2638392d08fb8
SHA1 22d84ca8e620ef5fc0027b3e06876d1a04d10406
SHA512 0ed902259cf218f0d1f6349ff4ee45b674f19f867cbbe7fee28cf80b7edf67e691738274df4b2c7be01aac60639c45e35717e2b9c59518bc6e1240a022acabf4
SSDEEP 6144:FQJmXLQwAhWUkJ0kfV50DEr2MxgTw7ozFD254W:FeeLQwAi07DWGcopfW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

venus

Malware Config

Signatures

Venus Ransomware 1 IoCs

resource	yara_rule
sample	family_venus

Venus family
venus

File Explorer

Venus.exe

.exe 225KB

Venus.exe

IMPHASH bb2600e94092da119ee6acbbd047be43
SHA256 4f92e2f752e4b0b30193d53375cd2fbd4beff02db9d6b3b6cadbf3b50e503498
MD5 07f5fbcb96179acffab2638392d08fb8
SHA1 22d84ca8e620ef5fc0027b3e06876d1a04d10406
SHA512 0ed902259cf218f0d1f6349ff4ee45b674f19f867cbbe7fee28cf80b7edf67e691738274df4b2c7be01aac60639c45e35717e2b9c59518bc6e1240a022acabf4
SSDEEP 6144:FQJmXLQwAhWUkJ0kfV50DEr2MxgTw7ozFD254W:FeeLQwAi07DWGcopfW
MD5 SHA1 SHA512 SSDEEP

windows x86

Venus Ransomware

Minor OS version

Major OS version

Entry point

22912

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

crypt32

CryptStringToBinaryA

comctl32

ord17 InitCommonControlsEx

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum

kernel32

Process32FirstW GetSystemInfo GetVersionExW GetModuleHandleA lstrcpyA GetProcAddress ExitProcess GetModuleHandleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetVolumeInformationW GetVolumePathNameW MulDiv GetCommandLineW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetFileSize QueryDosDeviceW ReadFile GetTempPathW CreateMutexW CreateProcessA lstrcatA IsWow64Process GetModuleFileNameA GetModuleFileNameW SetVolumeMountPointW Process32NextW ResumeThread WaitForMultipleObjects GetComputerNameExW lstrcmpiW GetSystemTime GetWindowsDirectoryW lstrcatW GetLastError Sleep GetCurrentThreadId CreateFileW lstrlenA WriteFile lstrlenW lstrcpyW CreateThread GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceW lstrcmpW GetProcessHeap CloseHandle HeapReAlloc OpenProcess Wow64DisableWow64FsRedirection WaitForSingleObject GetCurrentProcess VirtualAlloc

user32

DefWindowProcW GetWindowRect GetDC SetWindowPos MessageBoxW CreateWindowExW SendMessageW EndDialog GetSystemMetrics RegisterClassExW wsprintfA DispatchMessageW SetTimer RegisterHotKey TranslateMessage LoadCursorW GetClientRect GetDlgItem PostQuitMessage wsprintfW DrawTextW GetMessageW ReleaseDC SystemParametersInfoW ShowWindow LoadImageW

gdi32

CreateCompatibleBitmap BitBlt CreateFontW DeleteDC GetDeviceCaps SetBkMode SetTextColor DeleteObject GetTextExtentPoint32W SelectObject CreateCompatibleDC CreateDIBSection SetBkColor

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW SystemFunction036 RegQueryValueExW RegQueryValueExA RegCloseKey AllocateAndInitializeSid

shell32

SHGetPathFromIDListW CommandLineToArgvW ShellExecuteExW SHBrowseForFolderW SHEmptyRecycleBinW

ws2_32

ntohl inet_ntoa setsockopt socket gethostbyname WSAStartup inet_addr htons bind WSACleanup sendto

iphlpapi

SendARP GetAdaptersAddresses

netapi32

NetApiBufferFree NetShareEnum