Extracted

• • Target

    d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb

  • Size

    225KB

  • MD5

    67b1a741e020284593a05bc4b1a3d218

  • SHA1

    401e6815bbc62b092f96e93e9535f09d77aa4522

  • SHA256

    d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb

  • SHA512

    fc35cac1f925df0a516b4694658fc31a5fdb41ef8dee2a7d37d194e05ee06ec0f054494872f991ef90b46af7ee9ba0e2bd79a8c9109ca18d556f8b99be76067e

  • SSDEEP

    6144:w4bJmXqQwAhojkJZkYiV50DEruMxgTw7ozFD254W:w4NeqQwAhZb9DOGcopfW

  Score

  10^/10

  venusdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Venus

    Venus is a ransomware first seen in 2022.

    ransomwarevenus

  • Venus Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (8781) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3behavioral4