General
-
Target
e3e75e15fd7f6a8233e33c8a8e127cee36706025451644cf8618a0876fd0e95f.bin
-
Size
57KB
-
Sample
201109-nm293s1n1s
-
MD5
997f0ec7fcfa440d58443922651a2b0a
-
SHA1
6bd08ea17de7987451757b549984a443cf08b401
-
SHA256
e3e75e15fd7f6a8233e33c8a8e127cee36706025451644cf8618a0876fd0e95f
-
SHA512
c80320dc518936d88e283dc27a5cab5575d12f6c14af994ec79730aed31c61f89e631db1e04673a0dfa0ef8e56fd1ad4029def2210c3e0a3348c44cc6df11c1f
Static task
static1
Behavioral task
behavioral1
Sample
e3e75e15fd7f6a8233e33c8a8e127cee36706025451644cf8618a0876fd0e95f.bin.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
e3e75e15fd7f6a8233e33c8a8e127cee36706025451644cf8618a0876fd0e95f.bin.dll
Resource
win10v20201028
Malware Config
Extracted
C:\ProgramData\Microsoft\MF\F859A1-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Desktop\F859A1-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\F859A1-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\odt\C52B64-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\C52B64-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Documents\C52B64-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
e3e75e15fd7f6a8233e33c8a8e127cee36706025451644cf8618a0876fd0e95f.bin
-
Size
57KB
-
MD5
997f0ec7fcfa440d58443922651a2b0a
-
SHA1
6bd08ea17de7987451757b549984a443cf08b401
-
SHA256
e3e75e15fd7f6a8233e33c8a8e127cee36706025451644cf8618a0876fd0e95f
-
SHA512
c80320dc518936d88e283dc27a5cab5575d12f6c14af994ec79730aed31c61f89e631db1e04673a0dfa0ef8e56fd1ad4029def2210c3e0a3348c44cc6df11c1f
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-