General
-
Target
cv4TCGxUjvS.exe
-
Size
1.3MB
-
Sample
230904-g4a71aeb6s
-
MD5
f6b8f6b814763ee0befe3c55637f0c42
-
SHA1
3cf78ca5b35161a618efadf904abbaa161d7b02c
-
SHA256
5ed4dfb7da504438688d779092a717cb2426ee88bc4f0ee588b3e989b7567dff
-
SHA512
37fb6483bf598d3c52ea9dc1787fe7885b7439ec1a9bb6bb93486afd9d8d1650aeba2c819cc02cb3be3733722c63c00a3ecf605bcbac05fbaf6b7dec5047ff91
-
SSDEEP
12288:1BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoP5ouMA+nkGGCp+YE:WTcCG0447AMVgfdnTClVm4Q5cGRSS
Static task
static1
Behavioral task
behavioral1
Sample
cv4TCGxUjvS.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cv4TCGxUjvS.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
C:\Users\Admin\How To Restore Your Files.txt
http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/cfb52f38-0c93-4438-baf2-79db0554abf8/
https://www.binance.com/en/how-to-buy/bitcoin
Targets
-
-
Target
cv4TCGxUjvS.exe
-
Size
1.3MB
-
MD5
f6b8f6b814763ee0befe3c55637f0c42
-
SHA1
3cf78ca5b35161a618efadf904abbaa161d7b02c
-
SHA256
5ed4dfb7da504438688d779092a717cb2426ee88bc4f0ee588b3e989b7567dff
-
SHA512
37fb6483bf598d3c52ea9dc1787fe7885b7439ec1a9bb6bb93486afd9d8d1650aeba2c819cc02cb3be3733722c63c00a3ecf605bcbac05fbaf6b7dec5047ff91
-
SSDEEP
12288:1BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoP5ouMA+nkGGCp+YE:WTcCG0447AMVgfdnTClVm4Q5cGRSS
Score10/10-
Renames multiple (175) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-