General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd
-
Size
186KB
-
Sample
240719-em9m5asanj
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/31B0-2A5C-05DB-029E-DAA5
http://cerberhhyed5frqa.qor499.top/31B0-2A5C-05DB-029E-DAA5
http://cerberhhyed5frqa.gkfit9.win/31B0-2A5C-05DB-029E-DAA5
http://cerberhhyed5frqa.305iot.win/31B0-2A5C-05DB-029E-DAA5
http://cerberhhyed5frqa.dkrti5.win/31B0-2A5C-05DB-029E-DAA5
http://cerberhhyed5frqa.onion/31B0-2A5C-05DB-029E-DAA5
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Extracted
C:\Users\Admin\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/EEE6-2044-993D-029E-DB48
http://cerberhhyed5frqa.qor499.top/EEE6-2044-993D-029E-DB48
http://cerberhhyed5frqa.gkfit9.win/EEE6-2044-993D-029E-DB48
http://cerberhhyed5frqa.305iot.win/EEE6-2044-993D-029E-DB48
http://cerberhhyed5frqa.dkrti5.win/EEE6-2044-993D-029E-DB48
http://cerberhhyed5frqa.onion/EEE6-2044-993D-029E-DB48
Extracted
C:\Users\Admin\# DECRYPT MY FILES #.html
Targets
-
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
-
Contacts a large (16390) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Accessibility Features
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Accessibility Features
1