General
-
Target
53bba522663285740d740031f1878f7a4886b582ebcdbddc043afcd0dca70028
-
Size
368KB
-
Sample
200806-ekmp36z93n
-
MD5
38d00c31a81c5b9e1f468145cda774a3
-
SHA1
d9f6db88ff739713960f7b8d2706ad3f4704b287
-
SHA256
53bba522663285740d740031f1878f7a4886b582ebcdbddc043afcd0dca70028
-
SHA512
5ca3ed455b052e4a3a2b4f784910bc725d507683b98d2ac2aab0b6b258bc49f8cbada57bd6cfcec9f332b9ed2aaf8da59d79be817875826999a700c5c79e1027
Static task
static1
Behavioral task
behavioral1
Sample
53bba522663285740d740031f1878f7a4886b582ebcdbddc043afcd0dca70028.dll
Resource
win7
Behavioral task
behavioral2
Sample
53bba522663285740d740031f1878f7a4886b582ebcdbddc043afcd0dca70028.dll
Resource
win10v200722
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b170c9ae2a122c2
https://mazedecrypt.top/6b170c9ae2a122c2
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6cfb0ccf3daff8a6
https://mazedecrypt.top/6cfb0ccf3daff8a6
Targets
-
-
Target
53bba522663285740d740031f1878f7a4886b582ebcdbddc043afcd0dca70028
-
Size
368KB
-
MD5
38d00c31a81c5b9e1f468145cda774a3
-
SHA1
d9f6db88ff739713960f7b8d2706ad3f4704b287
-
SHA256
53bba522663285740d740031f1878f7a4886b582ebcdbddc043afcd0dca70028
-
SHA512
5ca3ed455b052e4a3a2b4f784910bc725d507683b98d2ac2aab0b6b258bc49f8cbada57bd6cfcec9f332b9ed2aaf8da59d79be817875826999a700c5c79e1027
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service
-
Sets desktop wallpaper using registry
-