General
-
Target
VirusShare_7263864b3ff85cdf8f4f58ba64a5ba31
-
Size
364KB
-
Sample
240610-nrvt7shh89
-
MD5
7263864b3ff85cdf8f4f58ba64a5ba31
-
SHA1
b4d82b021896c4c9af8ab6cf61423ea845f74601
-
SHA256
8fef8a2b184c918e92c862b9b6a42973c88528b79ec56836d3fc4f2086b1deb5
-
SHA512
cc23d8141e75417361aea5b6916326c8abf445d99b3cedf514ca4569f8ba528e45c3d5f2bf31f376b04dacea541ab218649967b49465bc9a60386e88f94c9ab8
-
SSDEEP
6144:hlqOZ/f3sN9020oeXa1JFhUBztIPCtrL7N0HVteM5XkIUAiFN8o2oJVz:3qOVf3s303UFyBzyPCV7O1tBFAAcNFj
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_7263864b3ff85cdf8f4f58ba64a5ba31.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
VirusShare_7263864b3ff85cdf8f4f58ba64a5ba31.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\+-xxx-HELP-xxx-+dwlnn-+.txt
http://9hrds.wolfcrap.at/D6C52C3E4BB19CFA
http://6g4ds.froekuge.com/D6C52C3E4BB19CFA
http://vewrb.italisumo.at/D6C52C3E4BB19CFA
http://k7tlx3ghr3m4n2tu.onion/D6C52C3E4BB19CFA
Extracted
C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+cvbhp-+.txt
http://9hrds.wolfcrap.at/A3FA93D18501AE
http://6g4ds.froekuge.com/A3FA93D18501AE
http://vewrb.italisumo.at/A3FA93D18501AE
http://k7tlx3ghr3m4n2tu.onion/A3FA93D18501AE
Targets
-
-
Target
VirusShare_7263864b3ff85cdf8f4f58ba64a5ba31
-
Size
364KB
-
MD5
7263864b3ff85cdf8f4f58ba64a5ba31
-
SHA1
b4d82b021896c4c9af8ab6cf61423ea845f74601
-
SHA256
8fef8a2b184c918e92c862b9b6a42973c88528b79ec56836d3fc4f2086b1deb5
-
SHA512
cc23d8141e75417361aea5b6916326c8abf445d99b3cedf514ca4569f8ba528e45c3d5f2bf31f376b04dacea541ab218649967b49465bc9a60386e88f94c9ab8
-
SSDEEP
6144:hlqOZ/f3sN9020oeXa1JFhUBztIPCtrL7N0HVteM5XkIUAiFN8o2oJVz:3qOVf3s303UFyBzyPCV7O1tBFAAcNFj
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-