General
-
Target
8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.sample
-
Size
296KB
-
Sample
210726-k7wgvskdj2
-
MD5
258ed03a6e4d9012f8102c635a5e3dcd
-
SHA1
a3bc2a30318f9bd2b51cb57e2022996e7f15c69e
-
SHA256
8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160
-
SHA512
967414274cb8d8fdf0e4dd446332b37060d54a726ab77f4ec704a5afe12162e098183add4342d1710db1e1c3b74035a001cf4c2d7790a27bf6d8381c34a96889
Behavioral task
behavioral1
Sample
8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.sample.exe
Resource
win10v20210408
Malware Config
Extracted
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\F8999B-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\F8999B-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Desktop\F8999B-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\50C07F-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Downloads\50C07F-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.sample
-
Size
296KB
-
MD5
258ed03a6e4d9012f8102c635a5e3dcd
-
SHA1
a3bc2a30318f9bd2b51cb57e2022996e7f15c69e
-
SHA256
8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160
-
SHA512
967414274cb8d8fdf0e4dd446332b37060d54a726ab77f4ec704a5afe12162e098183add4342d1710db1e1c3b74035a001cf4c2d7790a27bf6d8381c34a96889
Score10/10-
Detected Netwalker Ransomware
Detected unpacked Netwalker executable.
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-