General
-
Target
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe
-
Size
79KB
-
Sample
210429-7axzpkf1vj
-
MD5
dfaa9121f4165a9f38a8406d82f0ab71
-
SHA1
b592c787d347287efe410a43555e218e9ccfab10
-
SHA256
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523
-
SHA512
b00d24e7b38f66bb4ddadc75642d40afa6ba44fdfe832f9c2c4a074281736b0e0d66da512aac22eba3c8cecbdbe49152fab230233d75405e6ce5fbabe776e230
Static task
static1
Behavioral task
behavioral1
Sample
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe
Resource
win10v20210408
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/c9daf42fcfa6aca8432ecb7ffeff7f5e4e75f4ddd75f428c629bf6aa6a108a08/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/3eb91fac85bb0db5dde432443e998a3863f0f1c76e3449319178e6b78f5d3f44
Targets
-
-
Target
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe
-
Size
79KB
-
MD5
dfaa9121f4165a9f38a8406d82f0ab71
-
SHA1
b592c787d347287efe410a43555e218e9ccfab10
-
SHA256
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523
-
SHA512
b00d24e7b38f66bb4ddadc75642d40afa6ba44fdfe832f9c2c4a074281736b0e0d66da512aac22eba3c8cecbdbe49152fab230233d75405e6ce5fbabe776e230
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-