General
-
Target
067f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b.sample
-
Size
736KB
-
Sample
210726-b3nq2vc89x
-
MD5
21a563f958b73d453ad91e251b11855c
-
SHA1
64ed4f6b315448d518ed003a1d0c7e56790ef50d
-
SHA256
067f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b
-
SHA512
3eaef227db10759c65d668317322e71cd60e60427afd4d4f5f627e9b7a9d4e6d3287b7bf32df3fa7ba2f7062ec41393a100a477668b7f4dca76c2b8932c1b9eb
Static task
static1
Behavioral task
behavioral1
Sample
067f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b.sample.exe
Resource
win7v20210408
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/88dc09a45554daa8
https://mazedecrypt.top/88dc09a45554daa8
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/87f20988b6cede9f
https://mazedecrypt.top/87f20988b6cede9f
Targets
-
-
Target
067f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b.sample
-
Size
736KB
-
MD5
21a563f958b73d453ad91e251b11855c
-
SHA1
64ed4f6b315448d518ed003a1d0c7e56790ef50d
-
SHA256
067f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b
-
SHA512
3eaef227db10759c65d668317322e71cd60e60427afd4d4f5f627e9b7a9d4e6d3287b7bf32df3fa7ba2f7062ec41393a100a477668b7f4dca76c2b8932c1b9eb
-
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-