General
-
Target
0ea60d1ef2e6e5cff1e312e7ecd9df3146ddb87a81ede58fc74987df93288b31.exe
-
Size
146KB
-
Sample
240524-2h8llade51
-
MD5
668e75099ba454fa1cca10da33a9684a
-
SHA1
0adeef58c872f8fd1143070cff8fb2415a258189
-
SHA256
0ea60d1ef2e6e5cff1e312e7ecd9df3146ddb87a81ede58fc74987df93288b31
-
SHA512
bbc5a1e3bb0b64b4ae646e0d6dd1651ffa7258db87fe07e365a4cbff09a54cbbf9ee21ea4cf05b9f8e34ea122af85f4fb4b434da38705bee8b8ec9afd0f1b323
-
SSDEEP
1536:rzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDRM8o9cH789xVqw9sdFoEAUyz:UqJogYkcSNm9V7D/oSHQ9xVqw9sdjAT
Behavioral task
behavioral1
Sample
0ea60d1ef2e6e5cff1e312e7ecd9df3146ddb87a81ede58fc74987df93288b31.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0ea60d1ef2e6e5cff1e312e7ecd9df3146ddb87a81ede58fc74987df93288b31.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\QFXlqRR7Y.README.txt
https://getsession.org/
Extracted
C:\QFXlqRR7Y.README.txt
https://getsession.org/
Targets
-
-
Target
0ea60d1ef2e6e5cff1e312e7ecd9df3146ddb87a81ede58fc74987df93288b31.exe
-
Size
146KB
-
MD5
668e75099ba454fa1cca10da33a9684a
-
SHA1
0adeef58c872f8fd1143070cff8fb2415a258189
-
SHA256
0ea60d1ef2e6e5cff1e312e7ecd9df3146ddb87a81ede58fc74987df93288b31
-
SHA512
bbc5a1e3bb0b64b4ae646e0d6dd1651ffa7258db87fe07e365a4cbff09a54cbbf9ee21ea4cf05b9f8e34ea122af85f4fb4b434da38705bee8b8ec9afd0f1b323
-
SSDEEP
1536:rzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDRM8o9cH789xVqw9sdFoEAUyz:UqJogYkcSNm9V7D/oSHQ9xVqw9sdjAT
Score10/10-
Renames multiple (325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-