General
-
Target
12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375
-
Size
60KB
-
Sample
241219-bgen1szmfy
-
MD5
578b2dd255a8d491fec23bce4303e786
-
SHA1
4f66e8ab43418caf432d85a789e341c55f3fce9b
-
SHA256
12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375
-
SHA512
20945a43ea8b7fb5cd77cbcf2fa695b4132a5260e9adee3049fdd9f662cdac99b7fe2a02f9484d16bbfe16437d1861e1359b5db72898cc4037b898ecb140accb
-
SSDEEP
1536:+s27bk4Psu4M1k7e6LUz/KWMYUWXhJjkZ:+JAduIxLU7/MShBkZ
Static task
static1
Behavioral task
behavioral1
Sample
12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\!!!READ TO RECOVER YOUR DATA!!!.txt
moisha
https://tox.chat/
Targets
-
-
Target
12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375
-
Size
60KB
-
MD5
578b2dd255a8d491fec23bce4303e786
-
SHA1
4f66e8ab43418caf432d85a789e341c55f3fce9b
-
SHA256
12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375
-
SHA512
20945a43ea8b7fb5cd77cbcf2fa695b4132a5260e9adee3049fdd9f662cdac99b7fe2a02f9484d16bbfe16437d1861e1359b5db72898cc4037b898ecb140accb
-
SSDEEP
1536:+s27bk4Psu4M1k7e6LUz/KWMYUWXhJjkZ:+JAduIxLU7/MShBkZ
-
Moisha family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-