General
-
Target
VirusShare_00442a088456ce18a43187605557b3d1
-
Size
344KB
-
Sample
240610-mepa8agd55
-
MD5
00442a088456ce18a43187605557b3d1
-
SHA1
d02f19accf695508bc31a650539934d8ea46fb15
-
SHA256
d8ee200589d8e7d72878ea79bcfc9d18ee52569c046df74fa0dfe7e33d9ec422
-
SHA512
62d65da6e38ceae67845d44fe979941049d54075ca16ff0ed6b6db3379ccc30df55da5a4a2926e52147a48f0c11c2283fc1ee06864e8605bf31fb77b766656a7
-
SSDEEP
6144:V6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:sZOsSwhCGbWWu13E0
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_00442a088456ce18a43187605557b3d1.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
VirusShare_00442a088456ce18a43187605557b3d1.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\{RecOveR}-jhhxx__.Txt
http://h3ds4.maconslab.com/18F6C382C5671282
http://aq3ef.goimocoa.at/18F6C382C5671282
http://fl43s.toabolt.at/18F6C382C5671282
http://xzjvzkgjxebzreap.onion/18F6C382C5671282
Extracted
C:\Program Files\7-Zip\Lang\{RecOveR}-giiyk__.Txt
http://h3ds4.maconslab.com/15F6BB776512A4B
http://aq3ef.goimocoa.at/15F6BB776512A4B
http://fl43s.toabolt.at/15F6BB776512A4B
http://xzjvzkgjxebzreap.onion/15F6BB776512A4B
Targets
-
-
Target
VirusShare_00442a088456ce18a43187605557b3d1
-
Size
344KB
-
MD5
00442a088456ce18a43187605557b3d1
-
SHA1
d02f19accf695508bc31a650539934d8ea46fb15
-
SHA256
d8ee200589d8e7d72878ea79bcfc9d18ee52569c046df74fa0dfe7e33d9ec422
-
SHA512
62d65da6e38ceae67845d44fe979941049d54075ca16ff0ed6b6db3379ccc30df55da5a4a2926e52147a48f0c11c2283fc1ee06864e8605bf31fb77b766656a7
-
SSDEEP
6144:V6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:sZOsSwhCGbWWu13E0
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-