General
-
Target
877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample
-
Size
365KB
-
Sample
210726-8p9r5lnna2
-
MD5
be537a66d01c67076c8491b05866c894
-
SHA1
8614c5aa7abe3b91ffbc5637dd53bdff886aa1c1
-
SHA256
877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1
-
SHA512
b0581690fe78b0d5c1b934b2364065b1a373d89e1bbe9f68a94cf60203e9ae79d5b7708507cc0e7057fd51f8cf7ab2e012b46fa041cf80d4d967d09bb2c2e81d
Static task
static1
Behavioral task
behavioral1
Sample
877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe
Resource
win7v20210408
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/88dc09a47fb8b9ef
https://mazedecrypt.top/88dc09a47fb8b9ef
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/87f20988e91e09d6
https://mazedecrypt.top/87f20988e91e09d6
Targets
-
-
Target
877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample
-
Size
365KB
-
MD5
be537a66d01c67076c8491b05866c894
-
SHA1
8614c5aa7abe3b91ffbc5637dd53bdff886aa1c1
-
SHA256
877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1
-
SHA512
b0581690fe78b0d5c1b934b2364065b1a373d89e1bbe9f68a94cf60203e9ae79d5b7708507cc0e7057fd51f8cf7ab2e012b46fa041cf80d4d967d09bb2c2e81d
-
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-