embargo | _98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39.exe
Size 6.0MB
Sample260604-sfpw2ahs41
SHA256 98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39
MD5 21353d65b457518570bffc8a03038ee0
SHA1 b0c2e8ff737a4d3c331a5a581f7042eed4f69a9d
SHA512 a3a478a92fd5a1762e00f1adcac2d9f8ac8868b82c0e2e3cbddbc441333697d82e079fe3526ae4b67c5a674b4ff39229cb9c85f60f278525346c0f2d8804c282
SSDEEP 98304:xCl55swBqKJJLlcu2vwYyCfD8+tetZOVN+zhDH+dYaEoSu:qnBqxlxfD8+tetZYMzNH+dYaHS
TLSH
T102565B0AB913A9A9D57B65B0206FE335DE354C2C00079D77CFDA9E306A6E7113E4CA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware embargo

Malware Config

Signatures

Family: Embargo Ransomware
A Rust-based ransomware first observed in 2024.
ransomware embargo

Embargo Ransomware 1 IoCs

resource	yara_rule
sample	family_embargo

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39.exe

File Explorer

_98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39.exe

.exe 6.0MB

_98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39.exe

IMPHASH 34773aa4f6cf4d8f1a14b905cdde38e1
SHA256 98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39
MD5 21353d65b457518570bffc8a03038ee0
SHA1 b0c2e8ff737a4d3c331a5a581f7042eed4f69a9d
SHA512 a3a478a92fd5a1762e00f1adcac2d9f8ac8868b82c0e2e3cbddbc441333697d82e079fe3526ae4b67c5a674b4ff39229cb9c85f60f278525346c0f2d8804c282
SSDEEP 98304:xCl55swBqKJJLlcu2vwYyCfD8+tetZOVN+zhDH+dYaEoSu:qnBqxlxfD8+tetZYMzNH+dYaHS
TLSH
T102565B0AB913A9A9D57B65B0206FE335DE354C2C00079D77CFDA9E306A6E7113E4CA1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Embargo Ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AttachConsole CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreateMutexA CreateMutexW CreateNamedPipeW CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalDriveStringsW GetLogicalDrives GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList IsWow64Process LoadLibraryA LoadLibraryExA MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW RtlCaptureContext SetConsoleMode SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetProcessShutdownParameters SetThreadStackGuarantee SetUnhandledExceptionFilter SetVolumeMountPointW SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteConsoleW WriteFileEx CreateSemaphoreW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection ReleaseSemaphore VirtualProtect VirtualQuery

mpr

WNetAddConnection2W WNetCancelConnection2W WNetCloseEnum WNetEnumResourceW WNetOpenEnumW

netapi32

NetApiBufferFree NetShareEnum

ntdll

NtCreateFile NtReadFile NtWriteFile RtlNtStatusToDosError

ole32

CoCreateGuid

oleaut32

GetErrorInfo SetErrorInfo SysAllocStringLen SysFreeString SysStringLen

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmShutdown RmStartSession

shell32

SHEmptyRecycleBinW

userenv

GetUserProfileDirectoryW

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid ChangeServiceConfigW CloseServiceHandle ControlService EnumDependentServicesW EnumServicesStatusExW ImpersonateLoggedOnUser LogonUserW LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SystemFunction036

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __lconv_init __p__acmdln __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _iob _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

856KB

Virtual Size

856KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

540KB

Virtual Size

540KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

_98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39.exe

kernel32

mpr

netapi32

ntdll

ole32

oleaut32

rstrtmgr

shell32

userenv

ws2_32

advapi32

bcrypt

msvcrt

generic