General
-
Target
8_0.exe
-
Size
1.3MB
-
Sample
230904-g267naef48
-
MD5
d29bb5c5f43c21d91cb12bf3a4a4b0ee
-
SHA1
45dd48c869d05d6b2db428b26e0349fcddedfce3
-
SHA256
554990b8636baf5af393d52ce85150a8b263b9c5fb214bc0e69a1b032ee8f3ae
-
SHA512
a2fd971ab0306a4515cd44f00c4e3f269364851077ec4f4ca9837a2539934f7995ec2a5870509aec00627d1a57d9f5cfdfb9972b558e2f6ff5755dd8d5241353
-
SSDEEP
12288:FBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPpouMA+nkGGCp+CE:mTcCG0447AMVgfdnTClVm4QpcGRQS
Static task
static1
Behavioral task
behavioral1
Sample
8_0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8_0.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
C:\Users\How To Restore Your Files.txt
http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/79f69a7d-73d7-47b4-8152-89bf44664840/
https://www.binance.com/en/how-to-buy/bitcoin
Targets
-
-
Target
8_0.exe
-
Size
1.3MB
-
MD5
d29bb5c5f43c21d91cb12bf3a4a4b0ee
-
SHA1
45dd48c869d05d6b2db428b26e0349fcddedfce3
-
SHA256
554990b8636baf5af393d52ce85150a8b263b9c5fb214bc0e69a1b032ee8f3ae
-
SHA512
a2fd971ab0306a4515cd44f00c4e3f269364851077ec4f4ca9837a2539934f7995ec2a5870509aec00627d1a57d9f5cfdfb9972b558e2f6ff5755dd8d5241353
-
SSDEEP
12288:FBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPpouMA+nkGGCp+CE:mTcCG0447AMVgfdnTClVm4QpcGRQS
Score10/10-
Renames multiple (178) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-