General
-
Target
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce
-
Size
230KB
-
Sample
201117-atpazez1kn
-
MD5
2f78ff32cbb3c478865a88276248d419
-
SHA1
c4401bc85cdf162e3547645005060bd070e231a4
-
SHA256
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce
-
SHA512
1d989e475b7fbfa1f5c2704b94e7037443ecfe27cca81ade92a28dc91b2cebc1e0b47c6280c794d1020758a90be2f7f4ce98b6827d3c6d2c82610f28afdb2248
Static task
static1
Behavioral task
behavioral1
Sample
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce.dll
Resource
win10v20201028
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/86f4097f2b09b8c7
https://mazedecrypt.top/86f4097f2b09b8c7
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8820099734336a1
https://mazedecrypt.top/8820099734336a1
Targets
-
-
Target
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce
-
Size
230KB
-
MD5
2f78ff32cbb3c478865a88276248d419
-
SHA1
c4401bc85cdf162e3547645005060bd070e231a4
-
SHA256
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce
-
SHA512
1d989e475b7fbfa1f5c2704b94e7037443ecfe27cca81ade92a28dc91b2cebc1e0b47c6280c794d1020758a90be2f7f4ce98b6827d3c6d2c82610f28afdb2248
Score10/10-
Blacklisted process makes network request
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service
-