General
-
Target
ab6b0d00ba8f8553c015743b9da8761a9b1fca750d3f73bda573a8fbc47dafa1.sample
-
Size
6.5MB
-
Sample
210726-4kqjft2zhe
-
MD5
58beaa9058c8fc4e3be97806566ab495
-
SHA1
ed481af02c2909cca3b7a6bb7eb855bf92bb10c2
-
SHA256
ab6b0d00ba8f8553c015743b9da8761a9b1fca750d3f73bda573a8fbc47dafa1
-
SHA512
86165e1e115094592e32ab19caa18bcd59ae7164ed1f29dcc8c4ed50efe2e7e953cc32a0173d95b5a27c831170632069b0a98f1e451dc4931ea8965ad0d2c2c6
Static task
static1
Behavioral task
behavioral1
Sample
ab6b0d00ba8f8553c015743b9da8761a9b1fca750d3f73bda573a8fbc47dafa1.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ab6b0d00ba8f8553c015743b9da8761a9b1fca750d3f73bda573a8fbc47dafa1.sample.exe
Resource
win10v20210410
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RESTORE_HCEEM_DATA.txt
newrecoverybot@pm.me
13TvbUKYEAqwu3FP7RDu8vZhVucmUg9Zxy
Targets
-
-
Target
ab6b0d00ba8f8553c015743b9da8761a9b1fca750d3f73bda573a8fbc47dafa1.sample
-
Size
6.5MB
-
MD5
58beaa9058c8fc4e3be97806566ab495
-
SHA1
ed481af02c2909cca3b7a6bb7eb855bf92bb10c2
-
SHA256
ab6b0d00ba8f8553c015743b9da8761a9b1fca750d3f73bda573a8fbc47dafa1
-
SHA512
86165e1e115094592e32ab19caa18bcd59ae7164ed1f29dcc8c4ed50efe2e7e953cc32a0173d95b5a27c831170632069b0a98f1e451dc4931ea8965ad0d2c2c6
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-