Overview
overview
7Static
static
1fsociety-r...er.zip
windows10-2004-x64
1fsociety-r...er.zip
windows11-ltsc_2024-x64
1fsociety-r...DME.md
windows10-2004-x64
3fsociety-r...DME.md
windows11-ltsc_2024-x64
3fsociety-r...ql.sql
windows10-2004-x64
3fsociety-r...ql.sql
windows11-ltsc_2024-x64
3fsociety-r...ig.php
windows10-2004-x64
3fsociety-r...ig.php
windows11-ltsc_2024-x64
3fsociety-r...es.css
windows10-2004-x64
7fsociety-r...es.css
windows11-ltsc_2024-x64
3fsociety-r...er.jpg
windows10-2004-x64
1fsociety-r...er.jpg
windows11-ltsc_2024-x64
1fsociety-r...er.png
windows10-2004-x64
1fsociety-r...er.png
windows11-ltsc_2024-x64
1fsociety-r...ex.php
windows10-2004-x64
3fsociety-r...ex.php
windows11-ltsc_2024-x64
3fsociety-r...et.php
windows10-2004-x64
3fsociety-r...et.php
windows11-ltsc_2024-x64
3fsociety-r...ay.cpp
windows10-2004-x64
3fsociety-r...ay.cpp
windows11-ltsc_2024-x64
3fsociety-r..._day.h
windows10-2004-x64
3fsociety-r..._day.h
windows11-ltsc_2024-x64
3fsociety-r...ty.cpp
windows10-2004-x64
3fsociety-r...ty.cpp
windows11-ltsc_2024-x64
3fsociety-r...iety.h
windows10-2004-x64
3fsociety-r...iety.h
windows11-ltsc_2024-x64
3fsociety-r...in.cpp
windows10-2004-x64
3fsociety-r...in.cpp
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 23:00
Static task
static1
Behavioral task
behavioral1
Sample
fsociety-ransomware-MrRobot-master.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
fsociety-ransomware-MrRobot-master.zip
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
fsociety-ransomware-MrRobot-master/README.md
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
fsociety-ransomware-MrRobot-master/README.md
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
fsociety-ransomware-MrRobot-master/SQL/sql.sql
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
fsociety-ransomware-MrRobot-master/SQL/sql.sql
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
fsociety-ransomware-MrRobot-master/pages/config/config.php
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
fsociety-ransomware-MrRobot-master/pages/config/config.php
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
fsociety-ransomware-MrRobot-master/pages/css/styles.css
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
fsociety-ransomware-MrRobot-master/pages/css/styles.css
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral11
Sample
fsociety-ransomware-MrRobot-master/pages/images/jester.jpg
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
fsociety-ransomware-MrRobot-master/pages/images/jester.jpg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
fsociety-ransomware-MrRobot-master/pages/images/jester.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
fsociety-ransomware-MrRobot-master/pages/images/jester.png
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
fsociety-ransomware-MrRobot-master/pages/index.php
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
fsociety-ransomware-MrRobot-master/pages/index.php
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
fsociety-ransomware-MrRobot-master/pages/target.php
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
fsociety-ransomware-MrRobot-master/pages/target.php
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
fsociety-ransomware-MrRobot-master/source/after_day.cpp
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
fsociety-ransomware-MrRobot-master/source/after_day.cpp
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
fsociety-ransomware-MrRobot-master/source/after_day.h
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
fsociety-ransomware-MrRobot-master/source/after_day.h
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral23
Sample
fsociety-ransomware-MrRobot-master/source/fsociety.cpp
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
fsociety-ransomware-MrRobot-master/source/fsociety.cpp
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
fsociety-ransomware-MrRobot-master/source/fsociety.h
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
fsociety-ransomware-MrRobot-master/source/fsociety.h
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
fsociety-ransomware-MrRobot-master/source/main.cpp
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
fsociety-ransomware-MrRobot-master/source/main.cpp
Resource
win11ltsc2024-20260709-en
General
- Target fsociety-ransomware-MrRobot-master/source/main.cpp
- Size 806B
- Sample260711-2yzcvsds2w
- SHA256 b73d795bf4b4127be19c8680fd1f025de146118e943eb89d32ddd95b58dab1e1
- MD5 c52dc0b0f927951c89eaab5c9216cd54
- SHA1 33d166650e5071775e98bc89d97b706d0d2b0866
- SHA512 d228dc5cc066b02886bfe4ac461463e6f51741c9eb2c8167350dc82cb1228bed55fdf7a630009841432daf3398bd1a6cee7518943bef2642b1fff3f1cd46bb38
- TLSH T1E5018E02E8FF08569037469BA3AB500A0146DD478BE4C5AD3B66FE45AF3104FA4D66F5
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings cmd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2308 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\fsociety-ransomware-MrRobot-master\source\main.cpp1⤵
- Modifies registry class
PID:5408
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2308