General
- Target ядерка.bat
- Size 865B
- Sample260624-2fs35af19k
- SHA256 22e77448b1240d4fe54fb374f8f659cc22bdd4c6f2138bee2f4aef32f16d16e5
- MD5 a8ba5431612cb126fceb1121d778a2da
- SHA1 3a84cfed184ddfc15c4167a734a9c6c4eb14e902
- SHA512 1e669c8f769dea163c834d83324bd45b0df9695eb7a38ab8535f3bf4f0faaaf60f96b877223e3b7814325c92655622fbb05271fb8601e65d58c335cf3c1f9cd4
- TLSH T17C11A30115478722E652E4E0C5062543F36BF24B5831AD60B15370B8AD7D188CAFEFED
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
ядерка.bat
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ядерка.bat
Resource
win11ltsc2024-20260618-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target ядерка.bat
- Size 865B
- SHA256 22e77448b1240d4fe54fb374f8f659cc22bdd4c6f2138bee2f4aef32f16d16e5
- MD5 a8ba5431612cb126fceb1121d778a2da
- SHA1 3a84cfed184ddfc15c4167a734a9c6c4eb14e902
- SHA512 1e669c8f769dea163c834d83324bd45b0df9695eb7a38ab8535f3bf4f0faaaf60f96b877223e3b7814325c92655622fbb05271fb8601e65d58c335cf3c1f9cd4
- TLSH T17C11A30115478722E652E4E0C5062543F36BF24B5831AD60B15370B8AD7D188CAFEFED
- MD5 SHA1 SHA512 TLSH
-
Modifies WinLogon for persistence
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification