General
-
Target
a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117
-
Size
65KB
-
Sample
210511-dr4fz1yj96
-
MD5
7fd2d168d122ef3ce5f6290eeede293d
-
SHA1
714947ebce3dcfd5a77fe5949744e5095f04b497
-
SHA256
a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117
-
SHA512
73294aadca19f044011c307d55a8166616e5fd7ee6a2a485faf64b36301684e250797a6cf7503192960854fde2cb78547374dd57c6eda4fc8ff1fc78fb725171
Static task
static1
Behavioral task
behavioral1
Sample
a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117.exe
Resource
win7v20210408
Malware Config
Extracted
C:\Windows\TEMP\RESTORE_FILES_INFO.txt
http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454
Targets
-
-
Target
a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117
-
Size
65KB
-
MD5
7fd2d168d122ef3ce5f6290eeede293d
-
SHA1
714947ebce3dcfd5a77fe5949744e5095f04b497
-
SHA256
a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117
-
SHA512
73294aadca19f044011c307d55a8166616e5fd7ee6a2a485faf64b36301684e250797a6cf7503192960854fde2cb78547374dd57c6eda4fc8ff1fc78fb725171
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Drops file in System32 directory
-