General
-
Target
f978f89aac0a76c4b568194b502c8367ca804ab2eeb0c4efe1765d84b942a17b
-
Size
281KB
-
Sample
240531-pn91dshe74
-
MD5
9f3970b2f9304dd5335f935f3620615f
-
SHA1
350099ddb478c5a6c23fb93bb463b845581bbbff
-
SHA256
f978f89aac0a76c4b568194b502c8367ca804ab2eeb0c4efe1765d84b942a17b
-
SHA512
ad8838c34e056fd76f04dbfd416d6b2ad978b3cbf559becf00b98ca0436d332109fe907ef72090a1bb125613d5613a7c85cb165f5f75a263e12542e7bce4e909
-
SSDEEP
6144:z6EfK6u5yvXIq1FYBthpg+Ji7NuOMucQQ6ALqp:xLuEXIqHyhaqi7NRMucQR
Static task
static1
Behavioral task
behavioral1
Sample
f978f89aac0a76c4b568194b502c8367ca804ab2eeb0c4efe1765d84b942a17b.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f978f89aac0a76c4b568194b502c8367ca804ab2eeb0c4efe1765d84b942a17b.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\Users\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/c9daf42fcfa6aca8432ecb7ffeff7f5e4e75f4ddd75f428c629bf6aa6a108a08/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/3eb91fac85bb0db5dde432443e998a3863f0f1c76e3449319178e6b78f5d3f44
Targets
-
-
Target
f978f89aac0a76c4b568194b502c8367ca804ab2eeb0c4efe1765d84b942a17b
-
Size
281KB
-
MD5
9f3970b2f9304dd5335f935f3620615f
-
SHA1
350099ddb478c5a6c23fb93bb463b845581bbbff
-
SHA256
f978f89aac0a76c4b568194b502c8367ca804ab2eeb0c4efe1765d84b942a17b
-
SHA512
ad8838c34e056fd76f04dbfd416d6b2ad978b3cbf559becf00b98ca0436d332109fe907ef72090a1bb125613d5613a7c85cb165f5f75a263e12542e7bce4e909
-
SSDEEP
6144:z6EfK6u5yvXIq1FYBthpg+Ji7NuOMucQQ6ALqp:xLuEXIqHyhaqi7NRMucQR
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-