Overview
overview
7Static
static
1fsociety-r...er.zip
windows10-2004-x64
1fsociety-r...er.zip
windows11-ltsc_2024-x64
1fsociety-r...DME.md
windows10-2004-x64
3fsociety-r...DME.md
windows11-ltsc_2024-x64
3fsociety-r...ql.sql
windows10-2004-x64
3fsociety-r...ql.sql
windows11-ltsc_2024-x64
3fsociety-r...ig.php
windows10-2004-x64
3fsociety-r...ig.php
windows11-ltsc_2024-x64
3fsociety-r...es.css
windows10-2004-x64
7fsociety-r...es.css
windows11-ltsc_2024-x64
3fsociety-r...er.jpg
windows10-2004-x64
1fsociety-r...er.jpg
windows11-ltsc_2024-x64
1fsociety-r...er.png
windows10-2004-x64
1fsociety-r...er.png
windows11-ltsc_2024-x64
1fsociety-r...ex.php
windows10-2004-x64
3fsociety-r...ex.php
windows11-ltsc_2024-x64
3fsociety-r...et.php
windows10-2004-x64
3fsociety-r...et.php
windows11-ltsc_2024-x64
3fsociety-r...ay.cpp
windows10-2004-x64
3fsociety-r...ay.cpp
windows11-ltsc_2024-x64
3fsociety-r..._day.h
windows10-2004-x64
3fsociety-r..._day.h
windows11-ltsc_2024-x64
3fsociety-r...ty.cpp
windows10-2004-x64
3fsociety-r...ty.cpp
windows11-ltsc_2024-x64
3fsociety-r...iety.h
windows10-2004-x64
3fsociety-r...iety.h
windows11-ltsc_2024-x64
3fsociety-r...in.cpp
windows10-2004-x64
3fsociety-r...in.cpp
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/07/2026, 23:03
Static task
static1
Behavioral task
behavioral1
Sample
fsociety-ransomware-MrRobot-master.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
fsociety-ransomware-MrRobot-master.zip
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
fsociety-ransomware-MrRobot-master/README.md
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
fsociety-ransomware-MrRobot-master/README.md
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral5
Sample
fsociety-ransomware-MrRobot-master/SQL/sql.sql
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
fsociety-ransomware-MrRobot-master/SQL/sql.sql
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
fsociety-ransomware-MrRobot-master/pages/config/config.php
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
fsociety-ransomware-MrRobot-master/pages/config/config.php
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
fsociety-ransomware-MrRobot-master/pages/css/styles.css
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
fsociety-ransomware-MrRobot-master/pages/css/styles.css
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
fsociety-ransomware-MrRobot-master/pages/images/jester.jpg
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
fsociety-ransomware-MrRobot-master/pages/images/jester.jpg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
fsociety-ransomware-MrRobot-master/pages/images/jester.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
fsociety-ransomware-MrRobot-master/pages/images/jester.png
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
fsociety-ransomware-MrRobot-master/pages/index.php
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
fsociety-ransomware-MrRobot-master/pages/index.php
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
fsociety-ransomware-MrRobot-master/pages/target.php
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
fsociety-ransomware-MrRobot-master/pages/target.php
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
fsociety-ransomware-MrRobot-master/source/after_day.cpp
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
fsociety-ransomware-MrRobot-master/source/after_day.cpp
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
fsociety-ransomware-MrRobot-master/source/after_day.h
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
fsociety-ransomware-MrRobot-master/source/after_day.h
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
fsociety-ransomware-MrRobot-master/source/fsociety.cpp
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
fsociety-ransomware-MrRobot-master/source/fsociety.cpp
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral25
Sample
fsociety-ransomware-MrRobot-master/source/fsociety.h
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
fsociety-ransomware-MrRobot-master/source/fsociety.h
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral27
Sample
fsociety-ransomware-MrRobot-master/source/main.cpp
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
fsociety-ransomware-MrRobot-master/source/main.cpp
Resource
win11ltsc2024-20260709-en
General
- Target fsociety-ransomware-MrRobot-master/SQL/sql.sql
- Size 1KB
- Sample260711-2134tsds2x
- SHA256 dcffa1c97e60374370e3a061386c7502d26cf25c3b2816902847deac49762e37
- MD5 30eb32f81cc8b6fc858180318399a5cd
- SHA1 3a1415c05c17c01cc5efd5c87cdcf590de86bd61
- SHA512 b017136c4606cd40246c5c8a991524a72e9e77366edf56870ed82770ba9e8f9a0de97a68a702b223ba81fe394432da1d462abd8e21e73874ef63141e22efd183
- TLSH T1E6419A0D3F601642B25BC558D1D17BD3C837251B9A7AB8802EC4A29953017CB72BE6FB
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings cmd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4468 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\fsociety-ransomware-MrRobot-master\SQL\sql.sql1⤵
- Modifies registry class
PID:1328
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4468