General
-
Target
fb3f622cf5557364a0a3abacc3e9acf399b3631bf3630acb8132514c486751e7.zip
-
Size
1.8MB
-
Sample
210629-7elmh8yp8a
-
MD5
3c4cc59d0a025b4cc5b8ebf82d02aa5b
-
SHA1
0b4767598cdd02217c9ae2742804d50acb9ed8e4
-
SHA256
265bd3a207eb7dd52c22aa23ddfd14527ed7044b8de18fe0e5869e8326fec4d9
-
SHA512
da77499f6c2315f5ada6030571daea5df6fbde13f3affb539aa5c8a4cb39a76ece42e3bda5aac1e07bf2874aee4d5a08b3822a4bde325111f97e4adcb86214f6
Static task
static1
Behavioral task
behavioral1
Sample
fb3f622cf5557364a0a3abacc3e9acf399b3631bf3630acb8132514c486751e7.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
fb3f622cf5557364a0a3abacc3e9acf399b3631bf3630acb8132514c486751e7.exe
Resource
win10v20210410
Malware Config
Extracted
C:\$Recycle.Bin\NEFILIM-HELP.txt
http://corpleaks.net
http://hxt254aygrsziejn.onion
Targets
-
-
Target
fb3f622cf5557364a0a3abacc3e9acf399b3631bf3630acb8132514c486751e7.exe
-
Size
3.3MB
-
MD5
68bb371accb1bc914675c0ab626a9019
-
SHA1
802a5fc4f1fdfae4a8cf99a4544c191641f9bceb
-
SHA256
fb3f622cf5557364a0a3abacc3e9acf399b3631bf3630acb8132514c486751e7
-
SHA512
d72af358decda2f2caf1a7f1f6d83d457e0c6156753362a9ae1d3118dbb7706acff019be160028045ca2d22281fae4abf0ffdb6f27680cade0ade634e42bf84f
Score10/10-
Nefilim
Ransomware first seen in early 2020 which shares code with the Nemty family. Rewritten in Golang in July 2020.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-