General
-
Target
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin
-
Size
3.3MB
-
Sample
210612-kp14b1ebt2
-
MD5
1341f07df1c2c4841f1b0dc6641676f7
-
SHA1
9aedf3b45bb430358aefb81fb15ea93387d47436
-
SHA256
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c
-
SHA512
eab98a1a6632ce3cd940e219c218ec9704469aafe9bf5817a5397351cdf18a25dc69544d7051b416f46e4a1da74c3ef39f6a9750181084f522f9c876a54a0626
Static task
static1
Behavioral task
behavioral1
Sample
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe
Resource
win10v20210410
Malware Config
Extracted
C:\$Recycle.Bin\NEFILIM-HELP.txt
http://corpleaks.net
http://hxt254aygrsziejn.onion
Targets
-
-
Target
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin
-
Size
3.3MB
-
MD5
1341f07df1c2c4841f1b0dc6641676f7
-
SHA1
9aedf3b45bb430358aefb81fb15ea93387d47436
-
SHA256
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c
-
SHA512
eab98a1a6632ce3cd940e219c218ec9704469aafe9bf5817a5397351cdf18a25dc69544d7051b416f46e4a1da74c3ef39f6a9750181084f522f9c876a54a0626
Score10/10-
Nefilim
Ransomware first seen in early 2020 which shares code with the Nemty family. Rewritten in Golang in July 2020.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-