General
-
Target
f298725e197f974b7a8407c5d79114a4ac322c573813d543141ccf1d9119dd8b.bin
-
Size
69KB
-
Sample
201109-a8k1v9d6p6
-
MD5
d09cfda29f178f57dbce6895cfb68372
-
SHA1
82720e4d3fb83baff552ec25eea0fed2befe94fa
-
SHA256
f298725e197f974b7a8407c5d79114a4ac322c573813d543141ccf1d9119dd8b
-
SHA512
443d88fe0838ece8d194830e476d76dc1967c504dd082b77b1b57fe1e23497a84839f5d61d198207bace080b5ba7888c5604e10bf79c9ce5e91077fda5de0a20
Static task
static1
Behavioral task
behavioral1
Sample
f298725e197f974b7a8407c5d79114a4ac322c573813d543141ccf1d9119dd8b.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
f298725e197f974b7a8407c5d79114a4ac322c573813d543141ccf1d9119dd8b.bin.exe
Resource
win10v20201028
Malware Config
Extracted
C:\ProgramData\Microsoft\User Account Pictures\5B8DD0-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Java\jdk1.7.0_80\db\lib\5B8DD0-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Microsoft Office\Office14\PROOF\5B8DD0-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Oracle\Java\installcache_x64\F78EA9-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Downloads\F78EA9-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\AppData\Local\TileDataLayer\Database\F78EA9-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\F78EA9-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
f298725e197f974b7a8407c5d79114a4ac322c573813d543141ccf1d9119dd8b.bin
-
Size
69KB
-
MD5
d09cfda29f178f57dbce6895cfb68372
-
SHA1
82720e4d3fb83baff552ec25eea0fed2befe94fa
-
SHA256
f298725e197f974b7a8407c5d79114a4ac322c573813d543141ccf1d9119dd8b
-
SHA512
443d88fe0838ece8d194830e476d76dc1967c504dd082b77b1b57fe1e23497a84839f5d61d198207bace080b5ba7888c5604e10bf79c9ce5e91077fda5de0a20
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service
-