General
-
Target
b4be6b8acda97f36c448365751d5c9a9e1b91f47cedfde79e1de258413c3de71.exe
-
Size
79KB
-
Sample
210428-zh5vkwrhas
-
MD5
4161cbe9722d98ffe53636e9efa874ca
-
SHA1
c81aa4a4a5ac0eb22b8e9bf3024f2cd3b4db7eaa
-
SHA256
b4be6b8acda97f36c448365751d5c9a9e1b91f47cedfde79e1de258413c3de71
-
SHA512
3d39daa7ccc04e38cde0b0146b05422bd5e88a438f05aad8695ecb11740eb39149171b58b2bd71be481210a5066b7bcc07416366e369fb44e6c763efd92c7fe5
Static task
static1
Behavioral task
behavioral1
Sample
b4be6b8acda97f36c448365751d5c9a9e1b91f47cedfde79e1de258413c3de71.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b4be6b8acda97f36c448365751d5c9a9e1b91f47cedfde79e1de258413c3de71.exe
Resource
win10v20210410
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/c9daf42fcfa6aca8432ecb7ffeff7f5e4e75f4ddd75f428c629bf6aa6a108a08/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/3eb91fac85bb0db5dde432443e998a3863f0f1c76e3449319178e6b78f5d3f44
Targets
-
-
Target
b4be6b8acda97f36c448365751d5c9a9e1b91f47cedfde79e1de258413c3de71.exe
-
Size
79KB
-
MD5
4161cbe9722d98ffe53636e9efa874ca
-
SHA1
c81aa4a4a5ac0eb22b8e9bf3024f2cd3b4db7eaa
-
SHA256
b4be6b8acda97f36c448365751d5c9a9e1b91f47cedfde79e1de258413c3de71
-
SHA512
3d39daa7ccc04e38cde0b0146b05422bd5e88a438f05aad8695ecb11740eb39149171b58b2bd71be481210a5066b7bcc07416366e369fb44e6c763efd92c7fe5
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-