General
-
Target
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe
-
Size
94KB
-
Sample
201109-rmpqsb5nkx
-
MD5
69f1172b3f31746992b86467578d5ab2
-
SHA1
f24491dc99ad02f0d1c502b312df0b51670db738
-
SHA256
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe
-
SHA512
a893f5d07f3db175eec9441197b499ce856a089386a2d95f0dd4cd37734e060f9216125425f229841e8a8c825dddc2c26e82ccd41d802d7f55dbf0ea321b7c46
Static task
static1
Behavioral task
behavioral1
Sample
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe
Resource
win10v20201028
Malware Config
Extracted
C:\DC9F2-Readme.txt
netwalker
Extracted
C:\Program Files (x86)\Microsoft Office\Templates\1033\DC9F2-Readme.txt
netwalker
Extracted
C:\Users\Public\Libraries\CBC76-Readme.txt
netwalker
Extracted
C:\Users\Admin\Music\CBC76-Readme.txt
netwalker
Targets
-
-
Target
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe
-
Size
94KB
-
MD5
69f1172b3f31746992b86467578d5ab2
-
SHA1
f24491dc99ad02f0d1c502b312df0b51670db738
-
SHA256
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe
-
SHA512
a893f5d07f3db175eec9441197b499ce856a089386a2d95f0dd4cd37734e060f9216125425f229841e8a8c825dddc2c26e82ccd41d802d7f55dbf0ea321b7c46
Score10/10-
Detected Netwalker Ransomware
Detected unpacked Netwalker executable.
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Modifies service
-
Suspicious use of SetThreadContext
-