Overview

overview

10

Static

static

1

RNSM00473.7z

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RNSM00473.7z

  • Size

    67.0MB

  • Sample

    240925-jqepdawhjb

  • MD5

    d5d5de530fbb720527c68dccdc430d74

  • SHA1

    4dc21d744b484a6e27c3b9951826a1c21696266f

  • SHA256

    083f1d249b006db1d48ae65b2be283b457cc3d91ff99727847425398eee698ea

  • SHA512

    565d07e7060a435fdf6003ce94b32ef96fe5dd377a396c7c3a21a5f0af2a0c8bd36c618ac9342f76cece56c61ad23d1b8ed55a1390b5c8bf44b121b087cbebcc

  • SSDEEP

    1572864:uLesVc87NdbYvuKYoh9a8KmH4XZDlvPE82nxVtR+q:uLK8NBYvuKho8KhXZZPE8kxnD

Score
10/10
chaosmafiaware666vanillaratdiscoverypersistenceransomwareratupx

Malware Config

Targets

    • Target

      RNSM00473.7z

    • Size

      67.0MB

    • MD5

      d5d5de530fbb720527c68dccdc430d74

    • SHA1

      4dc21d744b484a6e27c3b9951826a1c21696266f

    • SHA256

      083f1d249b006db1d48ae65b2be283b457cc3d91ff99727847425398eee698ea

    • SHA512

      565d07e7060a435fdf6003ce94b32ef96fe5dd377a396c7c3a21a5f0af2a0c8bd36c618ac9342f76cece56c61ad23d1b8ed55a1390b5c8bf44b121b087cbebcc

    • SSDEEP

      1572864:uLesVc87NdbYvuKYoh9a8KmH4XZDlvPE82nxVtR+q:uLK8NBYvuKho8KhXZZPE8kxnD

    Score
    10/10
    chaosmafiaware666vanillaratdiscoverypersistenceransomwareratupx

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Detect MafiaWare666 ransomware

    • MafiaWare666 Ransomware

      MafiaWare666 is ransomware written in C# with multiple variants.

      ransomwaremafiaware666

    • VanillaRat

      VanillaRat is an advanced remote administration tool coded in C#.

      ratvanillarat

    • Renames multiple (93) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Vanilla Rat payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks