General
-
Target
91514e6be3f581a77daa79e2a4905dcbdf6bdcc32ee0f713599a94d453a26fc1.sample
-
Size
484KB
-
Sample
210726-nbba19vy26
-
MD5
8205a1106ae91d0b0705992d61e84ab2
-
SHA1
49cdc85728bf604a50f838f7ae941977852cc7a2
-
SHA256
91514e6be3f581a77daa79e2a4905dcbdf6bdcc32ee0f713599a94d453a26fc1
-
SHA512
8fc53dacd6b21ed9e1dc2a00edf154c40699754a116bdaf6566b8341c70ac293c8ba69d69a767af5ad8d0c8737a22dbe2609594983a1200375d40af3f4953b2e
Static task
static1
Behavioral task
behavioral1
Sample
91514e6be3f581a77daa79e2a4905dcbdf6bdcc32ee0f713599a94d453a26fc1.sample.exe
Resource
win7v20210410
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/87fe09937d76ac8c
https://mazedecrypt.top/87fe09937d76ac8c
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/86ac0975dd788539
https://mazedecrypt.top/86ac0975dd788539
Targets
-
-
Target
91514e6be3f581a77daa79e2a4905dcbdf6bdcc32ee0f713599a94d453a26fc1.sample
-
Size
484KB
-
MD5
8205a1106ae91d0b0705992d61e84ab2
-
SHA1
49cdc85728bf604a50f838f7ae941977852cc7a2
-
SHA256
91514e6be3f581a77daa79e2a4905dcbdf6bdcc32ee0f713599a94d453a26fc1
-
SHA512
8fc53dacd6b21ed9e1dc2a00edf154c40699754a116bdaf6566b8341c70ac293c8ba69d69a767af5ad8d0c8737a22dbe2609594983a1200375d40af3f4953b2e
-
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-