General
-
Target
739a7434533455d3b2d7926412a9ddb363c6c626185ef0efbc1dda2185f31485
-
Size
79KB
-
Sample
240925-xzst9asglk
-
MD5
0ea94d0397aab45a58b0b964355515ed
-
SHA1
a3cc337d09edfd268a7fda70525f12f2fcd34f72
-
SHA256
739a7434533455d3b2d7926412a9ddb363c6c626185ef0efbc1dda2185f31485
-
SHA512
8e7d25a35f78668ee3f4677009411060ff0841e22289568054299072bd278503dbc9a9a744cf076d5018bfe995f4383defbcb9d89ab86ee8216c0e40b41e2474
-
SSDEEP
1536:AlvQSweoWGSvsHD3ryEFmIt2HGdZcL4a32FRB9SO5sxTJhI7zJuqhZj7/:OQesnyEKHGjETirf5s7hU4EZ//
Static task
static1
Behavioral task
behavioral1
Sample
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Program Files\7-Zip\!!readme!!!.txt
underground
http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/
Targets
-
-
Target
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666
-
Size
146KB
-
MD5
059175be5681a633190cd9631e2975f6
-
SHA1
fb4ad5d21f0d8c6755eb4addba0ac288bd2574b6
-
SHA256
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666
-
SHA512
3a6c7667161ad9122785b6ef988d59f473b517e32e93c786c6a551d4c631f0ca82de1d262a056928935f05aa6723a7fe983158011e53042743194899c3e912e7
-
SSDEEP
3072:sdjFOoTVq4m0zRilymyU3pQuz1T5SKiVi6:4M2ZmEoL3Cu6K
-
Underground Team
Underground Team is a ransomware first seen in July 2023 that is primarily distriuted via exploting vulnerabilities.
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops desktop.ini file(s)
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-