General
-
Target
9543f71d7c4e394223c9d41ccef71541e1f1eb0cc76e8fa0f632b8365069af64.exe
-
Size
146KB
-
Sample
241007-b416jaxhmj
-
MD5
95eb004d05b5560426f75126bdd77649
-
SHA1
01b8d9eee21a269a02d0e8662a3ce2f9384d9169
-
SHA256
9543f71d7c4e394223c9d41ccef71541e1f1eb0cc76e8fa0f632b8365069af64
-
SHA512
45e17b6bac30e0ce0da8a76bd4e8ffce7aa1cb31056d57d0134e254753e53cefe17765a8aa3e5a9e657c50e78466e98e750631660b2c7ea8975fc77aa87b7eba
-
SSDEEP
3072:sdjFOoTVq4m0zRilymyU3pQuz1T5SKiVi6n:4M2ZmEoL3Cu6KI
Static task
static1
Behavioral task
behavioral1
Sample
9543f71d7c4e394223c9d41ccef71541e1f1eb0cc76e8fa0f632b8365069af64.exe
Resource
win11-20240802-en
Malware Config
Extracted
C:\Program Files\7-Zip\!!readme!!!.txt
underground
http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/
Targets
-
-
Target
9543f71d7c4e394223c9d41ccef71541e1f1eb0cc76e8fa0f632b8365069af64.exe
-
Size
146KB
-
MD5
95eb004d05b5560426f75126bdd77649
-
SHA1
01b8d9eee21a269a02d0e8662a3ce2f9384d9169
-
SHA256
9543f71d7c4e394223c9d41ccef71541e1f1eb0cc76e8fa0f632b8365069af64
-
SHA512
45e17b6bac30e0ce0da8a76bd4e8ffce7aa1cb31056d57d0134e254753e53cefe17765a8aa3e5a9e657c50e78466e98e750631660b2c7ea8975fc77aa87b7eba
-
SSDEEP
3072:sdjFOoTVq4m0zRilymyU3pQuz1T5SKiVi6n:4M2ZmEoL3Cu6KI
-
Underground Team
Underground Team is a ransomware first seen in July 2023 that is primarily distriuted via exploting vulnerabilities.
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops desktop.ini file(s)
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-