Key Group uses leaked builders of ransomware and wipers
Tags
Common Information
| Type | Value |
|---|---|
| UUID | 328136c8-9600-4a3c-a5bd-1e0dfaa5faf4 |
| Fingerprint | 8f0088db054104c5 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Oct. 1, 2024, 10 a.m. |
| Added to db | Oct. 1, 2024, 12:23 p.m. |
| Last updated | Oct. 12, 2024, 11:52 a.m. |
| Headline | Key Group: another ransomware group using leaked builders |
| Title | Key Group uses leaked builders of ransomware and wipers |
| Detected Hints/Tags/Attributes | 73/3/79 |
Source URLs
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 223 | ✔ | Securelist | https://securelist.com/feed/ | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 22 | bi.zone |
|
| Details | Domain | 61 | system.windows |
|
| Details | Domain | 115 | yandex.ru |
|
| Details | Domain | 253 | raw.githubusercontent.com |
|
| Details | Domain | 3759 | github.com |
|
| Details | Domain | 3 | fastxstreamz.herokuapp.com |
|
| Details | Domain | 3 | make-catherine.at.ply.gg |
|
| Details | File | 1 | warnep.exe |
|
| Details | File | 2 | keygroup777tg.exe |
|
| Details | File | 1 | россия-обновление.doc |
|
| Details | File | 29 | s.exe |
|
| Details | File | 1209 | explorer.exe |
|
| Details | File | 80 | taskkill.exe |
|
| Details | File | 2 | info-0v92.txt |
|
| Details | File | 1974 | cmd.exe |
|
| Details | File | 3 | keygroup777.txt |
|
| Details | File | 2 | dfff.exe |
|
| Details | File | 1 | fj6qd14qwc1uns2.exe |
|
| Details | File | 1 | cmd.url |
|
| Details | File | 1 | awindowsservice.exe |
|
| Details | File | 59 | taskhost.exe |
|
| Details | File | 1 | windowsx-c.exe |
|
| Details | File | 43 | system.exe |
|
| Details | File | 1 | _default64.exe |
|
| Details | File | 1 | native.exe |
|
| Details | File | 1 | ux-cryptor.exe |
|
| Details | File | 1 | crypt0rsx.exe |
|
| Details | File | 1 | spo90bqy4lpmysfc.exe |
|
| Details | File | 1 | telegram-raid-botnet.exe |
|
| Details | File | 1 | dlldata.exe |
|
| Details | File | 19 | l.exe |
|
| Details | File | 1 | llove.exe |
|
| Details | File | 2 | cheat.exe |
|
| Details | File | 52 | server.exe |
|
| Details | File | 15 | sfx.exe |
|
| Details | File | 1 | bater.exe |
|
| Details | File | 3 | setupdjprog-i0w0w04g8gww4ock.exe |
|
| Details | File | 48 | 3.exe |
|
| Details | File | 10 | at.pl |
|
| Details | md5 | 1 | C2E1048E1E5130E36AF297C73A83AFF6 |
|
| Details | md5 | 1 | 05FD0124C42461EF553B4B17D18142F9 |
|
| Details | md5 | 1 | D06B72CEB10DFED5ECC736C85837F08E |
|
| Details | md5 | 1 | 09CE91B4F137A4CBC1496D3791C6E75B |
|
| Details | md5 | 1 | 1FED852D312031974BF5EB988904F64E |
|
| Details | md5 | 1 | 6780495DAD7EB372F1A660811F4894A6 |
|
| Details | md5 | 1 | DA09FCF140D3AAD0390FB7FAF7260EB5 |
|
| Details | md5 | 1 | 56F5A95FFA6F89C24E0880C519A2AA50 |
|
| Details | md5 | 1 | C910DA0BAA2E08CEFCE079D1F7CB3469 |
|
| Details | md5 | 1 | E0C744162654352F5E048B7339920A76 |
|
| Details | md5 | 1 | F93695564B97F03CC95CA242EDCFB5F8 |
|
| Details | md5 | 1 | D655E77841CF6DB3008DCD60C9C5EB18 |
|
| Details | md5 | 1 | 7E1577B6E42D47B30AE597EEE720D3B1 |
|
| Details | md5 | 1 | 75F46171E81D6C5C81929AE6E3996257 |
|
| Details | md5 | 1 | 3BA80C2F430FAC5DEEC03788E5A438C3 |
|
| Details | md5 | 1 | 8EFCF0FA4EB05EFE76A3AE28FB193606 |
|
| Details | md5 | 1 | 46F8DE68E5348E1042461629B0B634A2 |
|
| Details | md5 | 1 | C2EDCC9211872B82475CB0EE3ADFED5D |
|
| Details | md5 | 1 | A095507117B229ECBC53D5F3B5F35ADF |
|
| Details | md5 | 1 | 404D831747E7713F2EA6D859B52CE9B3 |
|
| Details | md5 | 1 | 5AA991C89A6564A3C6351052E157F9D8 |
|
| Details | Microsoft Patch Numbers | 3 | KB3151800 |
|
| Details | Url | 1 | https://t.me/s/sbukr |
|
| Details | Url | 1 | https://t.me/s/sbukr?[username]_[generated_id]=[generated_key] |
|
| Details | Url | 2 | https://raw.githubusercontent.com/max444432/rms2/main/dfff.exe |
|
| Details | Url | 1 | https://github.com/json1c. |
|
| Details | Url | 1 | https://t.me/json1c. |
|
| Details | Url | 3 | https://raw.githubusercontent.com/max444432/rms2/main |
|
| Details | Url | 3 | http://fastxstreamz.herokuapp.com/913915/ndp462-kb3151800-x86-x64-allos-rus.scr?hash=agadzh |
|
| Details | Url | 3 | http://fastxstreamz.herokuapp.com/913034/setupdjprog-i0w0w04g8gww4ock.exe?hash=agadox |
|
| Details | Url | 3 | http://fastxstreamz.herokuapp.com/912974/3.exe?hash=agadob |
|
| Details | Windows Registry Key | 44 | HKLM\SOFTWARE\Policies\Microsoft\Windows |
|
| Details | Windows Registry Key | 94 | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
|
| Details | Windows Registry Key | 2 | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer |
|
| Details | Windows Registry Key | 157 | HKLM\SOFTWARE\Microsoft\Windows |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\Classes\.huis_bn |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\Classes\LGDAGXRNCRZHPLD\shell\open\command |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run |
|
| Details | Windows Registry Key | 39 | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
|
| Details | Windows Registry Key | 5 | HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run |