General
-
Target
VirusShare_683c46de5ff0b3453369565b86b3ae92
-
Size
344KB
-
Sample
240610-nrpceshh69
-
MD5
683c46de5ff0b3453369565b86b3ae92
-
SHA1
567bcdd4b1d38ab4f66b1caf5a30a88c32e67ba1
-
SHA256
e971b832058a8ac68376158f9def96d606b570e0b0b736b1c6cb590a6b9966a4
-
SHA512
650de6ff2cf892aa68461a0fcf6cb7a260762a79890b2b2fd426bfefa0b6ee47f0be1fa182723b6eb7d373f0eaaa0e9d566c26fdf5c79ce1ae34d98223017ca2
-
SSDEEP
6144:d6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:EZOsSwhCGbWWu13E0
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_683c46de5ff0b3453369565b86b3ae92.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
VirusShare_683c46de5ff0b3453369565b86b3ae92.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\{RecOveR}-asbpf__.Txt
http://h3ds4.maconslab.com/4F94A84235B416C9
http://aq3ef.goimocoa.at/4F94A84235B416C9
http://fl43s.toabolt.at/4F94A84235B416C9
http://xzjvzkgjxebzreap.onion/4F94A84235B416C9
Extracted
C:\Program Files\7-Zip\Lang\{RecOveR}-guwop__.Txt
http://h3ds4.maconslab.com/106CAAE2F3B5AD1B
http://aq3ef.goimocoa.at/106CAAE2F3B5AD1B
http://fl43s.toabolt.at/106CAAE2F3B5AD1B
http://xzjvzkgjxebzreap.onion/106CAAE2F3B5AD1B
Targets
-
-
Target
VirusShare_683c46de5ff0b3453369565b86b3ae92
-
Size
344KB
-
MD5
683c46de5ff0b3453369565b86b3ae92
-
SHA1
567bcdd4b1d38ab4f66b1caf5a30a88c32e67ba1
-
SHA256
e971b832058a8ac68376158f9def96d606b570e0b0b736b1c6cb590a6b9966a4
-
SHA512
650de6ff2cf892aa68461a0fcf6cb7a260762a79890b2b2fd426bfefa0b6ee47f0be1fa182723b6eb7d373f0eaaa0e9d566c26fdf5c79ce1ae34d98223017ca2
-
SSDEEP
6144:d6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:EZOsSwhCGbWWu13E0
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-