General
-
Target
IRSdeclarationcod.exe
-
Size
282KB
-
Sample
201015-d11m2zjdgs
-
MD5
fe3fd53ddc7c229b1150d970a05947c0
-
SHA1
3abeddbbbd29310290955cc7c1a895550c92ab96
-
SHA256
c414bbb789af8e3fb93b33344b31f1991582ec0f06558b29a3178d2b02465c72
-
SHA512
8b94e67f48f90d7a0e463a7623ba6f87a5f4108f33587c8f579f29aa3c9b0a22f7e134470824d25dccb552bfc868b18cd3f05ef09aaceef2bab6984c21f203b4
Static task
static1
Behavioral task
behavioral1
Sample
IRSdeclarationcod.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
IRSdeclarationcod.exe
Resource
win10v200722
Malware Config
Extracted
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\FD6F5D-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\FD6F5D-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\FD6F5D-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\5138E8-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\5138E8-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\5138E8-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
IRSdeclarationcod.exe
-
Size
282KB
-
MD5
fe3fd53ddc7c229b1150d970a05947c0
-
SHA1
3abeddbbbd29310290955cc7c1a895550c92ab96
-
SHA256
c414bbb789af8e3fb93b33344b31f1991582ec0f06558b29a3178d2b02465c72
-
SHA512
8b94e67f48f90d7a0e463a7623ba6f87a5f4108f33587c8f579f29aa3c9b0a22f7e134470824d25dccb552bfc868b18cd3f05ef09aaceef2bab6984c21f203b4
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service
-