General
-
Target
VirusShare_41fb9932be35e9e5ea61d74f8517c748
-
Size
222KB
-
Sample
240610-nfskpshd34
-
MD5
41fb9932be35e9e5ea61d74f8517c748
-
SHA1
69330b95b02db41a23198f164af47a151556e863
-
SHA256
e0aea54912d5f4e793d03303151a5d83b2d9c818b5ce8fa6ea3f609a3273114e
-
SHA512
c46c433a4cd5bd52ccf23a0d9ff705d1a8eaa123adae5b71f6f9a18a13281850af954850a074c45157dad352b0cce27b3ef6ac905d603344d3e4d86cd0b3aebc
-
SSDEEP
6144:FiIqk2kmqtVqu1S0IaQsG8c6Ty9Av4DObk:FLqzkvBSJ+G8XySgaI
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_41fb9932be35e9e5ea61d74f8517c748.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
VirusShare_41fb9932be35e9e5ea61d74f8517c748.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\-!RecOveR!-wchpo++.Txt
http://74bfc.flubspiel.com/A68E5BBC75E03753
http://ibf4d.ukegaub.at/A68E5BBC75E03753
http://k3cxd.pileanoted.com/A68E5BBC75E03753
http://xzjvzkgjxebzreap.onion/A68E5BBC75E03753
Extracted
C:\Program Files\Common Files\DESIGNER\-!RecOveR!-rmooc++.Txt
http://74bfc.flubspiel.com/8CEBE358D35D2297
http://ibf4d.ukegaub.at/8CEBE358D35D2297
http://k3cxd.pileanoted.com/8CEBE358D35D2297
http://xzjvzkgjxebzreap.onion/8CEBE358D35D2297
Targets
-
-
Target
VirusShare_41fb9932be35e9e5ea61d74f8517c748
-
Size
222KB
-
MD5
41fb9932be35e9e5ea61d74f8517c748
-
SHA1
69330b95b02db41a23198f164af47a151556e863
-
SHA256
e0aea54912d5f4e793d03303151a5d83b2d9c818b5ce8fa6ea3f609a3273114e
-
SHA512
c46c433a4cd5bd52ccf23a0d9ff705d1a8eaa123adae5b71f6f9a18a13281850af954850a074c45157dad352b0cce27b3ef6ac905d603344d3e4d86cd0b3aebc
-
SSDEEP
6144:FiIqk2kmqtVqu1S0IaQsG8c6Ty9Av4DObk:FLqzkvBSJ+G8XySgaI
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-