General
-
Target
VirusShare_6b3f01729d9f544a9ade26bdda98041f
-
Size
316KB
-
Sample
240610-nrq61shh76
-
MD5
6b3f01729d9f544a9ade26bdda98041f
-
SHA1
3d503f0a596f577e410c05cf1b314dd61424e560
-
SHA256
0658c6bbf1a37ec892996e2adc76ef0fb39c9e4dc197d05cf523748d56bf934e
-
SHA512
6cc5c368b083394c726e8c24134fdc797efa7a215c15e01e7fcb36a5c7c5d897ac2672bf774043429001e5e19cf328aff56e1523042f38611e2a161e0f974914
-
SSDEEP
6144:uRcNUBOfj1ANLQQ2ij56Nxvc78DgDDXxuRPS9kSdY0z7:l6Ie1QQVj54xC8cHXxuJUkGY
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_6b3f01729d9f544a9ade26bdda98041f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
VirusShare_6b3f01729d9f544a9ade26bdda98041f.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RECOVERweuma.txt
http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/E69BAD95628BC28
http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/E69BAD95628BC28
http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/E69BAD95628BC28
http://k7tlx3ghr3m4n2tu.onion/E69BAD95628BC28
Extracted
C:\PerfLogs\RECOVERtviyw.txt
http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/BC5B6AE34130BDBE
http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/BC5B6AE34130BDBE
http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/BC5B6AE34130BDBE
http://k7tlx3ghr3m4n2tu.onion/BC5B6AE34130BDBE
Targets
-
-
Target
VirusShare_6b3f01729d9f544a9ade26bdda98041f
-
Size
316KB
-
MD5
6b3f01729d9f544a9ade26bdda98041f
-
SHA1
3d503f0a596f577e410c05cf1b314dd61424e560
-
SHA256
0658c6bbf1a37ec892996e2adc76ef0fb39c9e4dc197d05cf523748d56bf934e
-
SHA512
6cc5c368b083394c726e8c24134fdc797efa7a215c15e01e7fcb36a5c7c5d897ac2672bf774043429001e5e19cf328aff56e1523042f38611e2a161e0f974914
-
SSDEEP
6144:uRcNUBOfj1ANLQQ2ij56Nxvc78DgDDXxuRPS9kSdY0z7:l6Ie1QQVj54xC8cHXxuJUkGY
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-