General
-
Target
18e299d4331ccff805275b21f33be0a3bd3d1d9ce72a79ba78d2f32dd657bfbb
-
Size
79KB
-
Sample
210413-p5y8k9fbvs
-
MD5
16c7212928b23a170cebb12935a933fa
-
SHA1
5d316698dfe20b8fcdc881dbf68632b13af11d0f
-
SHA256
18e299d4331ccff805275b21f33be0a3bd3d1d9ce72a79ba78d2f32dd657bfbb
-
SHA512
1f3f9d2486f0d2af768dd7d3537e98a97e856318a06e6a01972c1f58c8029151cfa29cdfaceff098daf8d7ac30bbe6b7bf1aa09c3c44f33ffda8cf0d08f98f0c
Static task
static1
Behavioral task
behavioral1
Sample
18e299d4331ccff805275b21f33be0a3bd3d1d9ce72a79ba78d2f32dd657bfbb.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
18e299d4331ccff805275b21f33be0a3bd3d1d9ce72a79ba78d2f32dd657bfbb.exe
Resource
win10v20210410
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/faca5581ddd262c4cfa85446f862883116ce07b04c69202579d8292ca1fb8a18/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://vq3zf757tzpwhs7bulnr43d2rfg5fkvvfkhee2zhhzievuxrbnarmgqd.onion/24a5bd3358eb457250046982645af76f346a5f5401a0e6175641860fd476a18a
Targets
-
-
Target
18e299d4331ccff805275b21f33be0a3bd3d1d9ce72a79ba78d2f32dd657bfbb
-
Size
79KB
-
MD5
16c7212928b23a170cebb12935a933fa
-
SHA1
5d316698dfe20b8fcdc881dbf68632b13af11d0f
-
SHA256
18e299d4331ccff805275b21f33be0a3bd3d1d9ce72a79ba78d2f32dd657bfbb
-
SHA512
1f3f9d2486f0d2af768dd7d3537e98a97e856318a06e6a01972c1f58c8029151cfa29cdfaceff098daf8d7ac30bbe6b7bf1aa09c3c44f33ffda8cf0d08f98f0c
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-