General
-
Target
2024-01-18_329b8aaea517a511908683b56446db99_revil
-
Size
126KB
-
Sample
240118-qzpdhadac3
-
MD5
329b8aaea517a511908683b56446db99
-
SHA1
9abe20a9c460a3e530cb96658541c6d25700a529
-
SHA256
c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20
-
SHA512
172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa
-
SSDEEP
1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA
Behavioral task
behavioral1
Sample
2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\10w27-readme.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C193AA5B7B749436
http://decoder.re/C193AA5B7B749436
Extracted
C:\Recovery\b39a7x9s1r-readme.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/121E315B4A0B181F
http://decoder.re/121E315B4A0B181F
Targets
-
-
Target
2024-01-18_329b8aaea517a511908683b56446db99_revil
-
Size
126KB
-
MD5
329b8aaea517a511908683b56446db99
-
SHA1
9abe20a9c460a3e530cb96658541c6d25700a529
-
SHA256
c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20
-
SHA512
172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa
-
SSDEEP
1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA
Score10/10-
Modifies Windows Firewall
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-