General
-
Target
svhost.exe.tojestmalware.exe
-
Size
56KB
-
Sample
230310-fmecnadd91
-
MD5
4230714977f5c09548b175207a2dd19f
-
SHA1
128188058d5ade9d2f89861795b994acc68efe0c
-
SHA256
ef2e0cc0c05fb633f539b333d88842ebef9a357d790fe1dd3cb28934be350d3f
-
SHA512
ae99d5844280931d4e1d3fde7ea8c5d267fd5d46c4a0196d305bbb2392d69103df377373ee56f2349ffb378ee2b40db341282a156aa84398bfaf93fcd2d92409
-
SSDEEP
768:GvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EYzkS8kXrrXNC:INeRBl5PT/rx1mzwRMSTdLpJYgSFNT
Static task
static1
Behavioral task
behavioral1
Sample
svhost.exe.tojestmalware.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
svhost.exe.tojestmalware.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\Users\Admin\Desktop\info.hta
https://tox.chat/
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\users\public\desktop\info.hta
https://tox.chat/
Targets
-
-
Target
svhost.exe.tojestmalware.exe
-
Size
56KB
-
MD5
4230714977f5c09548b175207a2dd19f
-
SHA1
128188058d5ade9d2f89861795b994acc68efe0c
-
SHA256
ef2e0cc0c05fb633f539b333d88842ebef9a357d790fe1dd3cb28934be350d3f
-
SHA512
ae99d5844280931d4e1d3fde7ea8c5d267fd5d46c4a0196d305bbb2392d69103df377373ee56f2349ffb378ee2b40db341282a156aa84398bfaf93fcd2d92409
-
SSDEEP
768:GvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EYzkS8kXrrXNC:INeRBl5PT/rx1mzwRMSTdLpJYgSFNT
Score10/10-
Modifies boot configuration data using bcdedit
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-