General
-
Target
21833028067.zip
-
Size
100KB
-
Sample
250326-gnsgcax1hx
-
MD5
5ef04d944799322d4e0d62ea214c64b3
-
SHA1
a20436042447f5217f61e3e35b6a17ddf22be7ed
-
SHA256
090580569f47c90376e9cdfae15b493939241c57600727b57fdf56a8606d06c5
-
SHA512
d7c438d45e8c3887974630ac4ba91132de70910f50d186e49fa5167559c850aae8f36a3f3947557d486e7b6df84b22c4d87a9533d17306a0cc4459b9884ad94f
-
SSDEEP
1536:4AQgl0G2kTm1yg+od/TyTLDs2TszekgdOWUlQC0+cNiMC6BoPFxw+mI:4Ktxy/TyTns2QzelgfaSJMC6Bod++mI
Behavioral task
behavioral1
Sample
a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\u3faqlCea.README.txt
https://www.girteka.eu
https://www.teleroute.com
https://www.nieddu.it
https://www.robustellitrasporti.it
https://www.matricardispa.com
https://www.monguzzitrasporti.it
https://logisica.com
https://itlmgroup.com
https://www.sogedim.it
https://www.dgftrans.it
https://www.garanteprivacy.it
https://signal.org/download/
https://getsession.org/download
Extracted
C:\Users\u3faqlCea.README.txt
https://www.girteka.eu
https://www.teleroute.com
https://www.nieddu.it
https://www.robustellitrasporti.it
https://www.matricardispa.com
https://www.monguzzitrasporti.it
https://logisica.com
https://itlmgroup.com
https://www.sogedim.it
https://www.dgftrans.it
https://www.garanteprivacy.it
https://signal.org/download/
https://getsession.org/download
Targets
-
-
Target
a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2
-
Size
149KB
-
MD5
7f040e7be2a5085703fe895d0625c925
-
SHA1
0be799d98e6719bfe594fb502e012e173bc0bfea
-
SHA256
a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2
-
SHA512
746b5b8b1c62e8e500e5d91fabb8c7a9ddae5a47440eb04babfc8a7a39dca89f51c2d846b5bc1993217c1dc7f8f6f9b2aa29b42b6a59c3fa5357cf48f020cfd1
-
SSDEEP
3072:+6glyuxE4GsUPnliByocWep9/PCTgLbvI1:+6gDBGpvEByocWebPAgLDI1
Score10/10-
Renames multiple (7707) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-