azov | 6d911ae1833c3f5c7c47df1c5abb03fc3e9a849a96bc4de8f31020046dfc0a75

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_samples.part021.rar
Size 15.0MB
Sample261011-v5hkcsvsc1
SHA256 6d911ae1833c3f5c7c47df1c5abb03fc3e9a849a96bc4de8f31020046dfc0a75
MD5 7e050dec5570f1d85d92d46c0f2a6565
SHA1 517723ec8999ddcc8e8ef572a002ff7bc523f70c
SHA512 c4ac108cab9787fd2f74aa4a1f130f5fcfa20dbbdd683dbb3df791ed1151e04fe6bc53a7f1d644d3718db71843a5c5ddf121973d3692d6fe57659895b8e19d92
SSDEEP 393216:u2coKwcungCsrRNKWWRH79uR24EHLKImd1StG9duz7FN0Nm3G4:h5KwcungZRNCJ7QMrTeOGWvC
TLSH
T156F63336A880780CE5F1E27BC6C61071F7D6BD6A2095B0A65156633E9EA8772C7FF430
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

mediaget

kazya1.hopto.org:1470

Mutex

a797c6ca3f5e7aff8fa1149c47fe9466

Attributes

reg_key
a797c6ca3f5e7aff8fa1149c47fe9466
splitter
|'|'|

Extracted

Family

blackmatter

Version

Botnet

bab21ee475b52c0c9eb47d23ec9ba1d1

https://paymenthacks.com
http://paymenthacks.com
https://mojobiden.com
http://mojobiden.com

Attributes

attempt_auth
false
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Family

quasar

Version

1.4.0.0

Botnet

2020

localpc.ddns.net:2875

Mutex

9eYfFGqpKrmsmWgGUu

Attributes

encryption_key
BzIpKazdKZENzsJa4Vf2
install_name
defender2020.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsDef2020
subdirectory
Defender2020

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

[email protected]

Extracted

Path

C:\Users\3zi3qam3O.README.txt

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R. >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R

Extracted

Path

C:\Users\Admin\Desktop\ransom_note.txt

Ransom Note

This is just a SetinelOne PoC Demo !!! YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email SplinterJoke and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files?

Extracted

Path

\Device\HarddiskVolume3\README.html

Ransom Note

<html><head><title>Venus</title><style type = "text/css">*{padding:0;margin:0}p{color:white}.f{background-color:#ff7c00;width:100%;margin-left:auto;margin-right:auto;height:100%}.c h1{color:white;line-height:80px}.r{word-break:break-all;float:left;width:100%;text-align:center}</style></head><body><div class="f"><div class="c"><h1 align="center"><<<Venus>>></h1></div><div class="r">We downloaded and encrypted your data.Only we can decrypt your data. IMPORTANT! If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay. In this case we will not be able to help you. Do not play with files.Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.-----------------------------------------------------Contact and send this file to us: email:[email protected] email:[email protected] MubK0t+FSMT2FaX/RtG/j0Jj1eJny2SehVZqgUr3/EY84Imj7bVfkMGAgjq17Ptr AyHb4lPoe3sIdto6mSBmvYn6qf8akOWWOt1aooTjTHKoLWGCkTYPrUOd1sjMdwgh +DAs9L6ATHGw0Seme0S1f6k1wvgFb0ByqibNxamMj8C5btVxby5LZ8noHk344Iuv FfNcIQKeQ6HQ05CTKUzyMXmzzQs/vUDjWoLM6w7k4ooO08Tnc/gI86KyezWckfgW rhEjvwvx+mtFsqvQg9fCjwUzTC4J2Hu/DIsMLB9gVwfPPFKF6z+mrwyd8Hj5M1NB oD4F4Nissm9nUtxqN9KeX01I7x6v/ibO/9PgTGkQDT4Q3kmd2m+44ZSCRAAK/6gg /Ds3ZpL6B6pl7VRZlqV4mylpYojl889XzvpUFT4uu8/lvtlIPASxqvKwg07sMRPi z4lfWQu5D1z5fMZxxICzUxOteACIyQeFCmxoPoG4MGTJUgZxe3t3HY2OhTngI+Rv lAMdRTpHAYdd5nU/06Q1cO7yOgjEHS4BuM6oKCWmqQXIeQ2aeGnqP+2/yBXkDLwY Rr+DTbkt4P0nNEULLZB93hUmDfjlnJX51hoV+qg39yx/8T/VsI0yN3xOketGW1DV Z4SmGwHVEgQb7Ngn/YVMjOeeN+LGrS5Fk9tf3EjUd42Ov08iySOm0rqKZXr7IDs= </div></body></html></html></body></html>

Emails

us: email:[email protected] email:[email protected] MubK0t+FSMT2FaX/RtG/j0Jj1eJny2SehVZqgUr3/EY84Imj7bVfkMGAgjq17Ptr

Extracted

Path

C:\Program Files (x86)\Readme_Instructions.html

Ransom Note

<!DOCTYPE HTML> <html><head><title>infected with ransomware virus</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> </head> <body style="margin: 0.4em; font-size: 14pt;">!!!    Your files are encrypted  !!! *All your files are protected with encryption* *There is no public decryption software.* *All files/documents/software with ".CRYPT" extension is encrypted* ###### Program and private key, What is the price? The price depends on how fast you can pay us.!###### 1 day : 50 Bitcoin 2 day : 60 Bitcoin 3 day : 90 Bitcoin 4 day : 130 Bitcoin 5 day    : permanent data loss !!!! ***How to contact our team through tox chat*** *Download tox chat from *<a href="https://tox.chat/download.html">https://tox.chat/download.html</a> *send us friend request to tox chat id 7D8796EB86CBF29F53F8A8447EABAF310ED898D9DEFF97AE09C1864C2A6B3B14ED8F82AE9B9D *Our team is waiting* !!!!For immediate decryption!!! write to our email: <a href="mailto:[email protected]">[email protected]</a> *After payment received, we will send private key to your IT department.!!!* *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.* !!! We have downloaded all your files to our servers and will release data if you do not comply.!!! !!! Do not attempt to decrypt your data using third-party software, this will result in permanent data loss.!!!</body></html>

Emails

href="mailto:[email protected]">[email protected]</a>

URLs

http-equiv="X-UA-Compatible"

Targets

- Target
  0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a.exe
- Size 163KB
- SHA256 0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a
- MD5 c5b6c3453d14458530ce6b38eb016973
- SHA1 884c0cd0125b00e60f9310cb58368a70947fb2dd
- SHA512 48b3bcb81730347ea9add2ca3534fa47884323dc8a0b1a2f90ba769006b1742681bba2f34f0bd8aab496cbc4cf6be7664e51b51675f73e8caa1b2bc4eab0ddd6
- SSDEEP 3072:1oCFpIr9DEHLPYBtBsGLUS3FTotB5CHcv+q1l3sBJBsbnKFi8zHf4K5ydVX50sqn:ur9DuLPOB1L330ySbm7ynXiNn
- TLSH
  T178F3F72439FB502DF1B3FEB55FD4B59B9E6FF7332A0A6469109103460B12E82DE91239
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution chaos impact persistence privilege_escalation ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (391) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2
- Target
  0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d.exe
- Size 37KB
- SHA256 0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d
- MD5 8eedc01c11b251481dec59e5308dccc3
- SHA1 24bf069e9f2a1f12aefa391674ed82059386b0aa
- SHA512 52388313b21f14aa69c8b37e0fe0b73f66aa92f08651a16c820aae65d341dc1af6b48f3c8d4f657ac990eeaf4b9a01ae769bca4d3625550011708697d22b69cc
- SSDEEP 384:HLWZcaCisD/WRdL5kyc/Ss4fzrngNsIhOrAF+rMRTyN/0L+EcoinblneHQM3epzN:iZcID5nc/Ss4HysIsrM+rMRa8NuM0t
- TLSH
  T156033B4D7FE18168C5FD057B05B2D41207BAE04F6E23D90E8EE5649A3B636C18F54AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

mediaget defense_evasion discovery njrat persistence privilege_escalation trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral3 behavioral4
- Target
  123227e58b482005a9669c39d31bdb154a0f32958423868a4d0262971e5a6497.exe
- Size 1.0MB
- SHA256 123227e58b482005a9669c39d31bdb154a0f32958423868a4d0262971e5a6497
- MD5 5c6f4f280e5fba76c585b9870dae75a2
- SHA1 2fba1d29d3d35975d90c3018d58a7eefcf269583
- SHA512 6884829292f13dd2241f4312baef5f566e8171fec1e0be72369396d3e58a202fb3aeeb6c3253e02baa13234b2012775622957b2ebffb109dbcf800d8ba09bde8
- SSDEEP 24576:UOkWG4cNwzsU4svqOczLlyr2f7o5ya8j80QZr5l:UMywYU4svqOczLpDza8FQ9/
- TLSH
  T14D357D5A33A4419AFEA7F0779A56C60BC6B1788E0337972F01E45A766F336701A1E331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery azov persistence privilege_escalation ransomware spyware stealer wiper
- Family: Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (10134) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe
- Size 223KB
- SHA256 41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629
- MD5 c27f23181c3ebd80f3dae27d88b86267
- SHA1 12bef40a06323256fc0e903503a49f4623af7dcb
- SHA512 b22159a971988198fee78f861ad938dfce12ba5b993593b7bfd4e54938b95d39b6f3d09ed4a9be7081181a8499a7aeac3a47a2edfab52812e7757c6d53d753ce
- SSDEEP 3072:8Cut7gBHz/0OUGyQkRACh3Uim7ef10wYaGyeG7sGcMBIGv:3udgBHz/pUNlRAC+bu1iaGy3Jv
- TLSH
  T10124F801F11FDBEAD69303BC4957A602BDBB36912B208EE783844A705D0B1D57AEDF91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery execution persistence privilege_escalation ransomware spyware stealer
- Renames multiple (9838) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral7 behavioral8
- Target
  47913d758d8c6e8395192eaf6928cbe33fde590f2839aa8521d8e83687de1e31.exe
- Size 5.4MB
- SHA256 47913d758d8c6e8395192eaf6928cbe33fde590f2839aa8521d8e83687de1e31
- MD5 6a336059f649a3143b1c68f2bbf41187
- SHA1 665532e4743075aae22b958bacab5dd4af4ee39f
- SHA512 9019bee8e01d1a48d06216180eb93fc7a0931989f624635dcba9dceb2aa08085cb1faa5472c18aa29df9dc3809400c6d2df10b8573228c8a99219c7bffd363ae
- SSDEEP 49152:GjLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:6Lu1TIRtUOV5Zv
- TLSH
  T161464A05B7D88526D4BF473A593393842371FC939C23876F31A0A26E7E717908D92B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution nominatuscrypto persistence privilege_escalation ransomware spyware stealer
- Detects NominatusCrypto C# variant
- Detects NominatusCrypto DOS executable variant
- Family: NominatusCrypto,NominatusStorm
  NominatusCrypto aka NominatusStorm is a ransomware written in C#.
  ransomware nominatuscrypto
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral10 behavioral9
- Target
  48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe
- Size 1.9MB
- SHA256 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521
- MD5 40ec0e62856036983be04f31ce670fb9
- SHA1 0d04b8139fe71a1736a8168fbf072df61d7d7bd6
- SHA512 1094d49d3fcb757fe2d1c49d1e441ab086f4cff80ffd8572b0017546350838dcba83f102796009d811a360f6825928c13e3697b7dd462627bb83fb92534fc806
- SSDEEP 192:z/TeYoeb67sc8+otH8SESePujd2kTCMZehZtzMuuQzBLerxA/GWeGMEd022XbTFi:z/yYoebe5JotHESxjuM63KI
- TLSH
  T10A95B071496B50CCD9FFA4516AC2E79CDE471F442A7CB0AB941C4A6B8B12004EF72F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution makop impact persistence ransomware spyware stealer trojan
- Family: Makop
  Ransomware family discovered by @VK_Intel in early 2020.
  ransomware makop
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Turns off Windows Defender SpyNet reporting
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Renames multiple (9603) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral11 behavioral12
- Target
  48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe
- Size 555KB
- SHA256 48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb
- MD5 eff424376edca5680b90ea9fedad163d
- SHA1 3c13c1e54d2d7991c1c3452ae89888a8e7a47763
- SHA512 5acc904da2b8f3371a5696194b4a6fa7c3e735b0bbe74a507efb56782e6fc604f9bd3abf7a3af5f57325c7115de3ac9cd499086430d0d4fbe81b46a57539f068
- SSDEEP 12288:Y4LNVuczF0QdQsJlehKRwYgJcViFYvgNv+5jGbRFhVoj4d:xvn2sJlBRwYgJcVNE+5jU8j4
- TLSH
  T168C48E217491C07AD67253F04EBCDB91256EFC340F721ACBE3C4196D1A7C5E16B32AAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution blackbasta impact ransomware
- Family: Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Sets desktop wallpaper using registry
  ransomware
behavioral13 behavioral14
- Target
  55219b5a69ccdf7002ca55831e6d04611861847eafb321ef54892d427c586f87.exe
- Size 363KB
- SHA256 55219b5a69ccdf7002ca55831e6d04611861847eafb321ef54892d427c586f87
- MD5 0b02ee2e49b0647393978b3013126752
- SHA1 8d12b9bb51c80b99ce39f3bc574d9ad509b954f8
- SHA512 1ea076d9afdc3c9728550ef666213aad22fa0a63bdb6162c5557cdec05f9d917b02789516160325b024e2a95e9e5445674850f5f6a21dc207d600adc26576645
- SSDEEP 6144:5aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371or:5uTs1gBpQL5kmh0671or
- TLSH
  T172840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan
- Detects Seven ransomware
- Family: Seven, SevenCrypt, 7ev3n
  Seven aka SevenCrypt or 7ev3n is a ransomware.
  ransomware seven
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral15 behavioral16
- Target
  55509a771fe9e7218e8acd9a9ce5150bd1f21956559dd28213a14266e22583c0.exe
- Size 2.6MB
- SHA256 55509a771fe9e7218e8acd9a9ce5150bd1f21956559dd28213a14266e22583c0
- MD5 51aa11d492b16e856d105368839e9105
- SHA1 9800d1db47238cffea6d5581b57bab555b6df82d
- SHA512 7385b5eec285d1e1b945555a757c2b055241d913944e32e8384f74da391213e514ada32356ef2a8788b81d5d52d01588e14bcb2a3e83a421db6425b79a999a99
- SSDEEP 24576:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKa:2jLuSh3i+FtvkMzT+A
- TLSH
  T1D5C55A4977D4C126C0BF0736487392852372F8979E1346AB34E4B32E7E757D04EA2AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution nominatuscrypto persistence privilege_escalation ransomware spyware stealer
- Detects NominatusCrypto C# variant
- Detects NominatusCrypto DOS executable variant
- Family: NominatusCrypto,NominatusStorm
  NominatusCrypto aka NominatusStorm is a ransomware written in C#.
  ransomware nominatuscrypto
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral17 behavioral18
- Target
  55926e8f3e48c5cc5a1e6279045a5ae39c26dcc79e84411d34f7b2158042a843.exe
- Size 66KB
- SHA256 55926e8f3e48c5cc5a1e6279045a5ae39c26dcc79e84411d34f7b2158042a843
- MD5 8e09e25c6dd51a06b9383457a5ec4b1e
- SHA1 bb04c8d83f8946c3e03386269b290fb338c07dae
- SHA512 5ff01b4a419f3e25b5b3b154b556dd847a33aff884e25fc2c827bdf7c2d10b77affb7908f46b7400c293470314984ad771303d6468c6909b86093af9fca0414b
- SSDEEP 1536:1zICS4AT6GxdEe+TOdincJXvKvWLBjklE:WR7auJXSOhCE
- TLSH
  T13A6339207181E0B3E466DBF3E70A75A2B349DE3A0D626817E9E80F086DF89536F15D47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery blackmatter ransomware spyware trojan
- Family: BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Renames multiple (141) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral19 behavioral20
- Target
  56990b801d101923eb89cf71604e9af32d7ce8d074f7dd50bd2877bf906542aa.exe
- Size 207KB
- SHA256 56990b801d101923eb89cf71604e9af32d7ce8d074f7dd50bd2877bf906542aa
- MD5 2ab217698d28e5d0a261c50da1e0bcef
- SHA1 5544362803911512b9bffa08220a2b622ee4a955
- SHA512 4454688ee87cfbfb9783a361d2c3aee809ab9f4c21ed689d9da5405934797cf43480b073e2a6fe7bd315b0b9cf36befdf17f49f1ac8c51da40db638c88010fff
- SSDEEP 1536:FXbWiuvCyvp1HqLvyyht/oFaM4Q56wbH5yck/dK1sCApy25hCyvp1HqaWN:FXbU6ynyekjdd8ynbWN
- TLSH
  T1FB2407B8C673CE3AF52C4A71286043480A36D33A7837C6EE3A8DB85D4E5DF543466A75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8.exe
- Size 3.0MB
- SHA256 63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8
- MD5 43463844f2ca09486f3e74596bd6993b
- SHA1 41070fe9ce92b1195ecd3f683d6b160bf0ec301d
- SHA512 241504c7f1f9c75d8694997a6c45693bebf47a4548912126dfae70dfb834e67fb0c88437cde09e5d61ddff118de5f481b90037889903c8d5fc242e6567914181
- SSDEEP 98304:aqXpy05Q0N1rsYSZ6BoXh1kkypSH3Oh5Bemg3A:n405QYtsTEB08T8HehLvt
- TLSH
  T102E5235128CBDC35CB7A24FE053BAA21E6D12D93D475931B3BA20E652A096B0CF4F4F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

costura defense_evasion discovery execution sorano_stealer packer spyware stealer upx
- Detects SoranoStealer payload
- Family: Sorano Stealer
  Sorano Stealer is an open-source information stealer written in C#.
  stealer sorano_stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft EdgeCookiesView
  Password recovery tool for Microsoft Edge browser
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23 behavioral24
- Target
  67628a5f04c7099346dd18957a4bc5179f5c3a07b41ca0d2a9e708dcab54d16d.exe
- Size 204KB
- SHA256 67628a5f04c7099346dd18957a4bc5179f5c3a07b41ca0d2a9e708dcab54d16d
- MD5 671ad98a0e0c83defa386673bed208c4
- SHA1 f90e106afe7a980137313a758cf90ab343a73e6c
- SHA512 0f7b816e15c7b3a5919fdcde4f4299b89a9eecc78fdc5adc969157e08b9bbd85ec6fd842521d8c8abdb59d13f8a85ec3986a294da86dcac98eeace06a4bc151c
- SSDEEP 3072:1H9R99nTRtB7lhy93yr5MgvRLT+Y+SHZSm+MPM+oFKpsE891VI:d9RLRfZTT+c7M+oIt
- TLSH
  T1AE2479262AF6105DF1F3AEBB47D9709AD5BEE7B2271344A931B103460623D439981F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (3064) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral25 behavioral26
- Target
  69417ec104c1dd07e5067110d6e7f3c643c534d14db65a704bc0c14c223c3001.elf
- Size 1.8MB
- SHA256 69417ec104c1dd07e5067110d6e7f3c643c534d14db65a704bc0c14c223c3001
- MD5 1dbd0412dca6472a30b5e9b5fb5090d2
- SHA1 d91b12755a674f20ebe9f2e85ab461e8e9610f49
- SHA512 0d78df9c09765e7e850d8d9fdee85b77ddbdca97d0e47f071a50cb1ad84ba8466ea96c15165296a242f8fa37309dfb99b6556e9359381414840206572e082b6c
- SSDEEP 49152:cqew+96PoBjYs5ngToDEZwTFgN+1Tt+t1:cqezRoX
- TLSH
  T1A5954B43F5A250BDD5BAC934836E6137F6317C0D41212A6B67D4EA203F59F209F1EBA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  72406ec12b191d2fa211cf1899e62c9257379d5bdd1d850c66cc546685f3d8ea.exe
- Size 2.2MB
- SHA256 72406ec12b191d2fa211cf1899e62c9257379d5bdd1d850c66cc546685f3d8ea
- MD5 ecf4ccc75a4d40f2b70f3e05b4f0695c
- SHA1 fcc5ba39aa2ef5b48e62270bb0a8880856b677d4
- SHA512 e719d0eafac81e313b7357aa11d7f60993f7be80d83c99ef938a7bf3ba96ebf634d0d8577d0dd63d5866c7cd8529a2097f781a2fd9aae0dc64b1f1ebcd3d6ce3
- SSDEEP 24576:VbLgurihdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+vbOSSqTPVXmiHkO:VnnMSPbcBVQej/1INRx+TSqTdX1HkQ
- TLSH
  T151B523D971AC92FCD2053A74947B8E23E6F23C6D21F96E0F9B404A751C03B5ABB50A53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery wannacry ransomware worm
- Family: Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3338) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral28 behavioral29
- Target
  74494d60aaa78a3af5ed734f5d981cdf32573eefe4a17be66013af895e2987b4.exe
- Size 403KB
- SHA256 74494d60aaa78a3af5ed734f5d981cdf32573eefe4a17be66013af895e2987b4
- MD5 801dfa0bfb890082c7e7f0394051f9eb
- SHA1 dc9b056cd1367f84b2d4bc03c90bcca6cd3eea8a
- SHA512 eb192ce8047787a4fc7e9628aca860ce8802e512ef28c4bafa667a7901c40a94259b1f58f085f035971ca59a710c80f4b7e7fcadd13020dcac8170625930b645
- SSDEEP 6144:jKJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkaH:WzCGL69zVGkllbka
- TLSH
  T13A945A2527E8A93BD9BE17B4F53141094BB6FC07B557F38E6A1818B82C1A34981837F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

2020 discovery execution quasar persistence spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral30 behavioral31
- Target
  78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361.exe
- Size 265KB
- SHA256 78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361
- MD5 3ac0d935228460fdc38bdab692d71b0c
- SHA1 d08f753af5b5d9be3352495189be6fd4914ad8e1
- SHA512 04376fc469808504a8071f0b9baa35c4f922d7b69c4d4c6e77309022f95cf916a80b758a6733154f36e8be59d928b93903eec47a6df32e96b2ef3b4b6f0fde54
- SSDEEP 6144:k9Pj5XJkcXV50DErs5xgTw7ozFz254WfRgzJmXrQwAN:akzDZGcoxfWfRglerQwAN
- TLSH
  T1E444BF10E6C290F2D8A70FBD98FA59FE90352A304735E3F7EBD54E9989366C2D138251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution neshta venus impact persistence ransomware spyware stealer
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Family: Venus
  Venus is a ransomware first seen in 2022.
  ransomware venus
- Venus Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (8478) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32