General
-
Target
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5
-
Size
69KB
-
Sample
201109-hjf586yrsn
-
MD5
3a601ee68000508d58ea12203449a202
-
SHA1
9068567b2b3fdae864ca9b1fb9013d0305e3ca83
-
SHA256
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5
-
SHA512
176d60567b2bcf89aa6338f3f14b22ee2592e4ea6349c0a51d67e5b7655de611c2a6e58495cab8d9c5c26deaef03ad19852a0f32cd37466fa3241d61395527b0
Static task
static1
Behavioral task
behavioral1
Sample
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe
Resource
win10v20201028
Malware Config
Extracted
C:\Program Files\Microsoft Office\Office14\5F6C34-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\5F6C34-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\5F6C34-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\odt\E2DF58-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\E2DF58-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\7-Zip\E2DF58-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\E2DF58-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5
-
Size
69KB
-
MD5
3a601ee68000508d58ea12203449a202
-
SHA1
9068567b2b3fdae864ca9b1fb9013d0305e3ca83
-
SHA256
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5
-
SHA512
176d60567b2bcf89aa6338f3f14b22ee2592e4ea6349c0a51d67e5b7655de611c2a6e58495cab8d9c5c26deaef03ad19852a0f32cd37466fa3241d61395527b0
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service
-