General
- Target KORA.exe
- Size 339KB
- Sample260702-twstashw81
- SHA256 c1c71e6e0d34caf9d41ba02f74ec6eea22c4e680ab1560a872b527263b63db81
- MD5 5aa26424d7539c1b7f03c5b2db467dba
- SHA1 b82354ed8c6124b45650a4e4879f046c9ac0399e
- SHA512 474d8bd3abe999034c4e1441d2c062aa5c7860fd136aaacf8c34e7d23562f1e34bc22e7fb8844342bae9b57887e8e3d2693efddc0ab433630a231e79e3c29cf0
- SSDEEP 6144:L5bie0CugX7AM3et+2Ivv90PJQijtqO6gaE:dgc7AM2Qv9aJQij
- TLSH T118748E59F7A414F9E2A7C17CCD524505EAB2BC164761ABCF23A00B963F276E08E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
KORA.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
KORA.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target KORA.exe
- Size 339KB
- SHA256 c1c71e6e0d34caf9d41ba02f74ec6eea22c4e680ab1560a872b527263b63db81
- MD5 5aa26424d7539c1b7f03c5b2db467dba
- SHA1 b82354ed8c6124b45650a4e4879f046c9ac0399e
- SHA512 474d8bd3abe999034c4e1441d2c062aa5c7860fd136aaacf8c34e7d23562f1e34bc22e7fb8844342bae9b57887e8e3d2693efddc0ab433630a231e79e3c29cf0
- SSDEEP 6144:L5bie0CugX7AM3et+2Ivv90PJQijtqO6gaE:dgc7AM2Qv9aJQij
- TLSH T118748E59F7A414F9E2A7C17CCD524505EAB2BC164761ABCF23A00B963F276E08E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Windows security modification
-
Drops desktop.ini file(s)