General
-
Target
d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.zip
-
Size
523KB
-
Sample
210705-xh9tfcanyj
-
MD5
dc1d961456ef80a7ccf81c584cf86a27
-
SHA1
01938d9c7272122a4885d7334807422acb5eca17
-
SHA256
cca8524bfc6f9e7d48bebcb99415b9740ecbbc55dc05ba9603421f6473b38b56
-
SHA512
3b4298b6670be077b0e04cdf4e72f6ed3e4c1a7f2d51e1f7c201493677ea9b60b67b2de6623221dd40875df0cf95632e0f7d08cfb1a106cf76156e5795f67030
Static task
static1
Behavioral task
behavioral1
Sample
d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe
Resource
win10v20210410
Malware Config
Extracted
C:\e8b5z40wh-readme.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/44377FAAB0C52E89
http://decoder.re/44377FAAB0C52E89
Targets
-
-
Target
d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe
-
Size
890KB
-
MD5
561cffbaba71a6e8cc1cdceda990ead4
-
SHA1
5162f14d75e96edb914d1756349d6e11583db0b0
-
SHA256
d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e
-
SHA512
09149b9825db2c9e6d2ec6665abc64b0b7aaafaa47c921c5bf0062cd7bedd1fc64cf54646a098f45fc4b930f5fbecee586fe839950c9135f64ea722b00baa50e
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-