Overview

overview

9

Static

static

3

smert.exe

windows7-x64

9

smert.exe

windows10-2004-x64

9

Resubmissions

24-08-2024 21:59

240824-1v7z6ateqk 10

28-07-2024 20:08

240728-ywzztswdnb 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    smert.exe

  • Size

    20KB

  • Sample

    240728-ywzztswdnb

  • MD5

    9741dc2a48ef315a5032a3190c6a9752

  • SHA1

    595cfcf134ac6a97a75407350b509ad37666d546

  • SHA256

    419b6c03a01ad10354c6f70c9077d0bc97a04ca03d0e39748823c8d604da7fe2

  • SHA512

    a8f26e08cdb7078f51f716014499f4af3f0be2ed057cbc3f67da38120d69534ff05a010ab8879ec5bfc692caac7db6f47e777d701d733a6cda307aaddb70cb6f

  • SSDEEP

    384:asaFiLCCr05Sx158JLLU4Act6GoMZOaB8BYsszReS:aPwXl1585LUNGoMZOXszR

Score
9/10
ransomware

Malware Config

Targets

    • Target

      smert.exe

    • Size

      20KB

    • MD5

      9741dc2a48ef315a5032a3190c6a9752

    • SHA1

      595cfcf134ac6a97a75407350b509ad37666d546

    • SHA256

      419b6c03a01ad10354c6f70c9077d0bc97a04ca03d0e39748823c8d604da7fe2

    • SHA512

      a8f26e08cdb7078f51f716014499f4af3f0be2ed057cbc3f67da38120d69534ff05a010ab8879ec5bfc692caac7db6f47e777d701d733a6cda307aaddb70cb6f

    • SSDEEP

      384:asaFiLCCr05Sx158JLLU4Act6GoMZOaB8BYsszReS:aPwXl1585LUNGoMZOXszR

    Score
    9/10
    ransomware

    • Renames multiple (2029) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks