General
-
Target
2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe
-
Size
126KB
-
Sample
230903-r9t76sba72
-
MD5
ff1f6956f07e700a86b5986b63ea12db
-
SHA1
a8d88813f2691cf71e8d6790e473593644c913ed
-
SHA256
3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545
-
SHA512
04f4d29f37079ef04e2b1be812d20d89dca82e4fffff28047de435425a18573cc3edfd5b148e0aded71d652583785e82585c708e0fc38b5dbda61962cbb1f927
-
SSDEEP
1536:YxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:YMhQNDEtb3A2ZHjUyWr4X5FTDUA
Behavioral task
behavioral1
Sample
2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
C:\Users\n430ar4kv-readme.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B1D679FE97CFEA5D
http://decoder.re/B1D679FE97CFEA5D
Extracted
C:\Recovery\8e1ikou-readme.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C228E7916B17DB67
http://decoder.re/C228E7916B17DB67
Targets
-
-
Target
2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe
-
Size
126KB
-
MD5
ff1f6956f07e700a86b5986b63ea12db
-
SHA1
a8d88813f2691cf71e8d6790e473593644c913ed
-
SHA256
3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545
-
SHA512
04f4d29f37079ef04e2b1be812d20d89dca82e4fffff28047de435425a18573cc3edfd5b148e0aded71d652583785e82585c708e0fc38b5dbda61962cbb1f927
-
SSDEEP
1536:YxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:YMhQNDEtb3A2ZHjUyWr4X5FTDUA
Score10/10-
Modifies Windows Firewall
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-