General
-
Target
29aef790399029029e0443455d72a8b928854a0706f2e211ae7a03bba0e3d4f4.bin
-
Size
69KB
-
Sample
201109-gnlnjj6eha
-
MD5
645c720ff0eb7d946ec3b4a6f609b7bc
-
SHA1
16094d75f4bb593b196210e5d082a7abcdce1d8c
-
SHA256
29aef790399029029e0443455d72a8b928854a0706f2e211ae7a03bba0e3d4f4
-
SHA512
d3e470bb2d4e7b8cac7aaa1b37cec7948337bae3014bc46ab777031ca194309c1ae9a689e1017f41c4638273dac7f03f9ae9532d1dc0fa94af6e3c8418c7659b
Static task
static1
Behavioral task
behavioral1
Sample
29aef790399029029e0443455d72a8b928854a0706f2e211ae7a03bba0e3d4f4.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
29aef790399029029e0443455d72a8b928854a0706f2e211ae7a03bba0e3d4f4.bin.exe
Resource
win10v20201028
Malware Config
Extracted
C:\Recovery\9f428062-1991-11eb-b2ba-ee401b9e63cb\466D17-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\Office14\466D17-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Pictures\466D17-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\odt\D6EB30-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\Network\Downloader\D6EB30-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\VideoLAN\VLC\lua\playlist\D6EB30-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
29aef790399029029e0443455d72a8b928854a0706f2e211ae7a03bba0e3d4f4.bin
-
Size
69KB
-
MD5
645c720ff0eb7d946ec3b4a6f609b7bc
-
SHA1
16094d75f4bb593b196210e5d082a7abcdce1d8c
-
SHA256
29aef790399029029e0443455d72a8b928854a0706f2e211ae7a03bba0e3d4f4
-
SHA512
d3e470bb2d4e7b8cac7aaa1b37cec7948337bae3014bc46ab777031ca194309c1ae9a689e1017f41c4638273dac7f03f9ae9532d1dc0fa94af6e3c8418c7659b
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service
-