General
-
Target
a51961ba_by_Libranalysis
-
Size
29KB
-
Sample
210511-bt91fsgvxn
-
MD5
a51961badad00c66fddf3a72f85327d6
-
SHA1
18c6e911ade4d82fda26af54c183129421c919e0
-
SHA256
5ea6a1afc900ff3765b3838827e024e324e5180a7674fd1bf59c02425db1a745
-
SHA512
240b8eb9d5494dde0e4e284a781246bebd10a87eb18c6de4c8e0338193650d1acc83590b7c7a41c8090759e80f4407eca09b1a2f586d22e1e7af94a75e6f4b88
Static task
static1
Behavioral task
behavioral1
Sample
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe
Resource
win10v20210410
Malware Config
Extracted
C:\Documents and Settings\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://os3xs2l3ftdqeuhxyuo4e6ymxvknp3gx6abordkcjde4coe37k66xyid.onion/4ee7ff7421bcb2ab35c523623ce11174c037e7db0562578b8a245630fc16a047
Targets
-
-
Target
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe
-
Size
79KB
-
MD5
f0d4c7d334633a72a3c7bd722e12c378
-
SHA1
5240f71f60c473b5f9ba100d2ce1d6effdbc08c1
-
SHA256
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1
-
SHA512
780809b5b877b3d693179d7635dadd80b0aa5e2943761b7623d0d923a34979cad363f4b5c2fcca22105a48c4dc34a71af5624cc28aaf0d086559aa206d9e315c
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-