General
-
Target
5c4de6456271f61616e.bin.zip
-
Size
4.8MB
-
Sample
201122-wp9m9rmfwa
-
MD5
59891a925dae6729d10b644ca6c48d6d
-
SHA1
baecb1ecb459e659b2f9a225c671579016a9052d
-
SHA256
22af4328b17e362db11b4cddf7fe9e94bb435a570ac05662e077c67418d75ca3
-
SHA512
58e43d6cbea8af99661d336d5647a16e13c985850c312735d604ff748a9f2252be2947683c51ddd386988f351d54fa9bfada3f550229c3f56ef98f6f2bd5fec3
Static task
static1
Behavioral task
behavioral1
Sample
5c4de6456271f61616e.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
5c4de6456271f61616e.bin.exe
Resource
win10v20201028
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/86f4097fd3426269
https://mazedecrypt.top/86f4097fd3426269
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/87f6098d7582aee4
https://mazedecrypt.top/87f6098d7582aee4
Targets
-
-
Target
5c4de6456271f61616e.bin
-
Size
4.9MB
-
MD5
35fe9d41aa9c31a1191ae2e7a3f442aa
-
SHA1
ccbb554db60782a5f6a5317a8718214c0527b766
-
SHA256
c7fb04d2fc49fdb1215a256757b27d06d71c4797e28ad5c4de6456271f61616e
-
SHA512
6e3198270a641b4fe9a21c0f04a7d1f576414d0dc8a9b65fd5be01f3d32ad6e083a381b0f61a6b1b658342912c56d73528ac0661edf13844bea45c1ae3100010
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service
-
Sets desktop wallpaper using registry
-