General
-
Target
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample
-
Size
3.0MB
-
Sample
201210-bknpcabj6e
-
MD5
1441e78b9e6ce78dd02e7491b25e7f9e
-
SHA1
8c355fd0e062152a403cb0c42412850b60524aac
-
SHA256
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e
-
SHA512
52e34a8ea136783e2009700b330e7db32e817ab0420c77e6cf47ab79c385635036ac4b547d6d1ee7542eb1e2e0b88f741289b96bf66dde18f1fdd03cb554d023
Static task
static1
Behavioral task
behavioral1
Sample
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exe
Resource
win10v20201028
Malware Config
Extracted
C:\$Recycle.Bin\INFECTION-HELP.txt
http://corpleaks.net
http://hxt254aygrsziejn.onion
Targets
-
-
Target
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample
-
Size
3.0MB
-
MD5
1441e78b9e6ce78dd02e7491b25e7f9e
-
SHA1
8c355fd0e062152a403cb0c42412850b60524aac
-
SHA256
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e
-
SHA512
52e34a8ea136783e2009700b330e7db32e817ab0420c77e6cf47ab79c385635036ac4b547d6d1ee7542eb1e2e0b88f741289b96bf66dde18f1fdd03cb554d023
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-