General
-
Target
54c82ad27174fd6ed72793b1ccf9d26613eb572960e847a63538420c69d06c5b.exe
-
Size
79KB
-
Sample
210502-q53p7r9knj
-
MD5
eacfeff2add22da202bc6ba34308989e
-
SHA1
7b41f9077fba77d9a3115c3e8142c3f15c81d84a
-
SHA256
54c82ad27174fd6ed72793b1ccf9d26613eb572960e847a63538420c69d06c5b
-
SHA512
481912d2271a9c96147dd91c03b4180abfa16a99525a27779bba996dd893d87aae8e58d3da41250aa20020827e777b457dad0e9a21b55b898dd99248db74e74f
Static task
static1
Behavioral task
behavioral1
Sample
54c82ad27174fd6ed72793b1ccf9d26613eb572960e847a63538420c69d06c5b.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
54c82ad27174fd6ed72793b1ccf9d26613eb572960e847a63538420c69d06c5b.exe
Resource
win10v20210410
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/da83db34f2e0c077f7b064e6556f127c0a91d7ae21f3855f0e7279ce14d5f406/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://vq3zf757tzpwhs7bulnr43d2rfg5fkvvfkhee2zhhzievuxrbnarmgqd.onion/3fbf8f220dae00bb6bb8539b9c6c86c4bf5c58ccf651542e3363dd131239edd6
Targets
-
-
Target
54c82ad27174fd6ed72793b1ccf9d26613eb572960e847a63538420c69d06c5b.exe
-
Size
79KB
-
MD5
eacfeff2add22da202bc6ba34308989e
-
SHA1
7b41f9077fba77d9a3115c3e8142c3f15c81d84a
-
SHA256
54c82ad27174fd6ed72793b1ccf9d26613eb572960e847a63538420c69d06c5b
-
SHA512
481912d2271a9c96147dd91c03b4180abfa16a99525a27779bba996dd893d87aae8e58d3da41250aa20020827e777b457dad0e9a21b55b898dd99248db74e74f
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-