General
-
Target
ed0f154481261e9a08dcc4f7e4d396bce75526811216106daa70d4148c660d76.exe
-
Size
79KB
-
Sample
210420-vvh2sqr4dx
-
MD5
d6fc9e993c69aceb7a5501641fc823fa
-
SHA1
7839b437b279d3f0ec22a57df7ea84ad01322c17
-
SHA256
ed0f154481261e9a08dcc4f7e4d396bce75526811216106daa70d4148c660d76
-
SHA512
afd92c03d357ebbccd495017d5f7738ab83fadd865f008037a30ed326768c583acbb8858da73aea85b1b3c37d3dd4baeec4d0c9a0a09dd0bac26b15d65d7b3c6
Static task
static1
Behavioral task
behavioral1
Sample
ed0f154481261e9a08dcc4f7e4d396bce75526811216106daa70d4148c660d76.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
ed0f154481261e9a08dcc4f7e4d396bce75526811216106daa70d4148c660d76.exe
Resource
win10v20210408
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/7907aef660251acf19895fb5a805cefa7d37819ccfad83835d1492d5d96bf286/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/9091cf99461b326d4bf5ed0eaa849a7c58e9678a426aa910392ea3e1f8cc85f6
Targets
-
-
Target
ed0f154481261e9a08dcc4f7e4d396bce75526811216106daa70d4148c660d76.exe
-
Size
79KB
-
MD5
d6fc9e993c69aceb7a5501641fc823fa
-
SHA1
7839b437b279d3f0ec22a57df7ea84ad01322c17
-
SHA256
ed0f154481261e9a08dcc4f7e4d396bce75526811216106daa70d4148c660d76
-
SHA512
afd92c03d357ebbccd495017d5f7738ab83fadd865f008037a30ed326768c583acbb8858da73aea85b1b3c37d3dd4baeec4d0c9a0a09dd0bac26b15d65d7b3c6
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-