General
-
Target
bb31f235e86b0fda185e6580ef5327f80d6a6c754f78499e8647de5e229769cc
-
Size
79KB
-
Sample
210419-n9khd25ky6
-
MD5
b8e5bd86046b596d8cf43843f433bb5d
-
SHA1
e4934d730f999bc2bc0e05fec3b9afe324d8a32b
-
SHA256
bb31f235e86b0fda185e6580ef5327f80d6a6c754f78499e8647de5e229769cc
-
SHA512
470f1ebc145db53436e545e12172ec9db362f5868819878cacb7f6ca4c1730cd93abc6939ef10a251eee69ba6adf8ea4accb257a4136dbe007b746077a9b0928
Static task
static1
Behavioral task
behavioral1
Sample
bb31f235e86b0fda185e6580ef5327f80d6a6c754f78499e8647de5e229769cc.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
bb31f235e86b0fda185e6580ef5327f80d6a6c754f78499e8647de5e229769cc.exe
Resource
win10v20210410
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/5cc4505a0bcb13aa5b01043e61918c8f576f615482d298be39068653b9fcde4d/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/07a6fcfe223abe38cd6238fdffb4b7ef7f2f342e9a86e3ea7a994195eb73b459
Targets
-
-
Target
bb31f235e86b0fda185e6580ef5327f80d6a6c754f78499e8647de5e229769cc
-
Size
79KB
-
MD5
b8e5bd86046b596d8cf43843f433bb5d
-
SHA1
e4934d730f999bc2bc0e05fec3b9afe324d8a32b
-
SHA256
bb31f235e86b0fda185e6580ef5327f80d6a6c754f78499e8647de5e229769cc
-
SHA512
470f1ebc145db53436e545e12172ec9db362f5868819878cacb7f6ca4c1730cd93abc6939ef10a251eee69ba6adf8ea4accb257a4136dbe007b746077a9b0928
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-