General
-
Target
a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
-
Size
3.0MB
-
Sample
210421-mwb88p1jjn
-
MD5
c0d30c047b185328d266078965a68b37
-
SHA1
989ee095844cd41520e395e7e85aea475e572c1d
-
SHA256
a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327
-
SHA512
7aa4b947fbdc5e04f3a25b1401420cebb776ab51a05bfdc45996bfcd0e979368f1b7143d23fc45e128f102d2e53fcc40ae2971229f67fc0df18a74146655e105
Static task
static1
Behavioral task
behavioral1
Sample
a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
Resource
win10v20210410
Malware Config
Extracted
C:\$Recycle.Bin\BENTLEY-HELP.txt
BENTLEY@icloud.com
http://corpleaks.net
http://hxt254aygrsziejn.onion
Targets
-
-
Target
a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
-
Size
3.0MB
-
MD5
c0d30c047b185328d266078965a68b37
-
SHA1
989ee095844cd41520e395e7e85aea475e572c1d
-
SHA256
a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327
-
SHA512
7aa4b947fbdc5e04f3a25b1401420cebb776ab51a05bfdc45996bfcd0e979368f1b7143d23fc45e128f102d2e53fcc40ae2971229f67fc0df18a74146655e105
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-