b11a0b47a97f979bb9a2b14b3115776edc07e7969a4ed5a1089a634d2aa78ffd | Triage™

Login
Reports

Overview

overview

7

Static

static

3

Vonda.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
VONDA BACK.zip
Size 21.6MB
Sample260802-25el2agp81
SHA256 b11a0b47a97f979bb9a2b14b3115776edc07e7969a4ed5a1089a634d2aa78ffd
MD5 3386a930cd294420793f99a35dfcc789
SHA1 0ebd559d8e277fafa2e40b670f66cc9b69ec91c4
SHA512 e02f913057d2241afc06f9d3dfdaeb645481069bed922576706ebf1208b461e918e99af8c4e871ef9f660dd1d8a8e2861feac1d9404eb5c679cc843ed21726d3
SSDEEP 393216:UJt3tavqNCxyJf1L18vRO3dFGS980LgGufBaZcIAYszEqGcFGAkxj4:U/1v1W800gGupSPq1Fr
TLSH
T14537339AB5E3C53AF954E222BFD415D06041267AAF498EF5D1F78000BC58384E9F3DAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Vonda.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

8 signatures

900 seconds

defense_evasion discovery persistence ransomware

Malware Config

Targets

- Target
  Vonda.exe
- Size 263KB
- SHA256 9ca2d6c391842900f3d5975e34fbc5a99e173a1ac32899aee72092f3ea8ec84e
- MD5 7f9301485ca87217da1b7e9ca1287e29
- SHA1 3d60c8d3004611f236ec2b0fc43206b3400fba1d
- SHA512 d28e50ada3ac49d3c571d0e087ce37c5eaa5555e40a079e0055f77044586aa4b86bad73b2e7a6dce66efd9dce686166ea5994b25eeefb116aa72efaaaee49cec
- SSDEEP 6144:pFjFsHu2sS3g5Cwqv1iR2opIRvmO9YIA6qZEbr//o25u:pFjuHnt3gXq9iR2op19GTgQ
- TLSH
  T107440162377AEE96D0320B7504B1E5806DB0BC3B9D15CAAB79C8335F7A393149983B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence ransomware
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceransomware

© 2018-2026

Terms | Privacy