General
-
Target
c4282e9040cdc1df92b722568a8b4c42ce9f6533fed0bd34b7fdbae264947784
-
Size
79KB
-
Sample
210419-9fg3tvf7he
-
MD5
024382eef9abab8edd804548f94b78fc
-
SHA1
b69a5385d880f4d0acd3358df002aba42b12820f
-
SHA256
c4282e9040cdc1df92b722568a8b4c42ce9f6533fed0bd34b7fdbae264947784
-
SHA512
011bd185ef5aef409dbd198f59829d9812d2b1ead69e867e8b9983eb7c742356b074b17383c17fe22f417b61e6aaf7858cbb9e3abd5d25d02f256b69834c42d4
Static task
static1
Behavioral task
behavioral1
Sample
c4282e9040cdc1df92b722568a8b4c42ce9f6533fed0bd34b7fdbae264947784.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
c4282e9040cdc1df92b722568a8b4c42ce9f6533fed0bd34b7fdbae264947784.exe
Resource
win10v20210408
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/55a5aa93131ff81478afe895d99ccb1e5350128a6a85abe0955dc9af55c31e66/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/92c51a11c29950b07fc1e46c752e7d40a363ce64447d698442331feaf7de7397
Targets
-
-
Target
c4282e9040cdc1df92b722568a8b4c42ce9f6533fed0bd34b7fdbae264947784
-
Size
79KB
-
MD5
024382eef9abab8edd804548f94b78fc
-
SHA1
b69a5385d880f4d0acd3358df002aba42b12820f
-
SHA256
c4282e9040cdc1df92b722568a8b4c42ce9f6533fed0bd34b7fdbae264947784
-
SHA512
011bd185ef5aef409dbd198f59829d9812d2b1ead69e867e8b9983eb7c742356b074b17383c17fe22f417b61e6aaf7858cbb9e3abd5d25d02f256b69834c42d4
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-