General
-
Target
alt.bin.zip
-
Size
1.1MB
-
Sample
200813-9dxdx6s52x
-
MD5
93e25d829d01e60b057ad0e8e1aca10d
-
SHA1
a5ac337a53220d97fdc31a8d95cbfafed8e4992c
-
SHA256
1a562dfa68723f6670fc2ed1e52196cc0af94a00bae123c3fca040b16ae3f08c
-
SHA512
2756e7feb33d1d2001ee60733a29f60d3483e40f1508ae25ad107c9d243efa660c51e014ddf0cfd334c203fff8afe62bf1cb351714ce25e19541daf10e33a7e7
Static task
static1
Behavioral task
behavioral1
Sample
alt.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
alt.bin.exe
Resource
win10v200722
Malware Config
Extracted
C:\\NEF1LIM-DECRYPT.txt
http://corpleaks.net
http://hxt254aygrsziejn.onion
Targets
-
-
Target
alt.bin
-
Size
3.0MB
-
MD5
5235242923a537b58b7064082dad7432
-
SHA1
2a044e5e3dde62ded6a3f2a5a634067168a41810
-
SHA256
c2b9f3b84e3e990e2c225e05ea65e7a3aaaf5a688864d0ee68ed2eece557fac0
-
SHA512
6811036c65152f772b6f2e539b7bec657cb0cc7255f8b00271e5d51017e4734a2ebee18133c38411ee4eb0acb3803b030fa19e009d3cb7b95f721098488213bd
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-