General
-
Target
678bfbf5d73d6cf38532e11b11dbed17668d94711e2e2ea27311dd46490201b7.zip
-
Size
29KB
-
Sample
210427-heew82lt1j
-
MD5
eb3042c4f65a43dc3e52512b82614281
-
SHA1
b9d0084845d718429834fa263dfe80630f5feae5
-
SHA256
9ef944c4b603047486abc2bb11c6059b8839a224bec7a817df19cdd283e2b000
-
SHA512
6f94c5834707cb1a643a3e33cecc2c3456ab684a949b870b44baa352dabcd43ab4b2075e6b52f8845040ab5360a073eb414b4d9728193fad6af308ef52e5149e
Static task
static1
Behavioral task
behavioral1
Sample
678bfbf5d73d6cf38532e11b11dbed17668d94711e2e2ea27311dd46490201b7.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
678bfbf5d73d6cf38532e11b11dbed17668d94711e2e2ea27311dd46490201b7.exe
Resource
win10v20210410
Malware Config
Extracted
C:\Documents and Settings\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/c9daf42fcfa6aca8432ecb7ffeff7f5e4e75f4ddd75f428c629bf6aa6a108a08/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/3eb91fac85bb0db5dde432443e998a3863f0f1c76e3449319178e6b78f5d3f44
Targets
-
-
Target
678bfbf5d73d6cf38532e11b11dbed17668d94711e2e2ea27311dd46490201b7.exe
-
Size
79KB
-
MD5
ebe7bf69eceb80d155d7a16b8c61e15c
-
SHA1
5c8b0a23360420c33fb89e100fb996215a795a1f
-
SHA256
678bfbf5d73d6cf38532e11b11dbed17668d94711e2e2ea27311dd46490201b7
-
SHA512
76b0bb1a5a0fb0e90c06a8f6448a3116789788c5c35fab9f64a9122665a5a579d8336699a90cdb1db540395d6a37f107171440a4be6a84b6afa34fe69cecbbff
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-