General
-
Target
84895601f472240234162ba7ac9a7b0952df8268c93f6ab385eeccb5aea7d120.sample
-
Size
40KB
-
Sample
210726-w44qvnpkvs
-
MD5
de7c8dfe5e8050571ef394f0202edc82
-
SHA1
a03468953575a4730689d6d05558792150125ac8
-
SHA256
84895601f472240234162ba7ac9a7b0952df8268c93f6ab385eeccb5aea7d120
-
SHA512
874643de409b9c4e7fcb5c8727db3ab060a195b2411625e66c7e2fe5e03eecc5c21fd07e82f7edc38792a614f57e1a7e195d535057bec09cf256aafae9892bd4
Static task
static1
Behavioral task
behavioral1
Sample
84895601f472240234162ba7ac9a7b0952df8268c93f6ab385eeccb5aea7d120.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
84895601f472240234162ba7ac9a7b0952df8268c93f6ab385eeccb5aea7d120.sample.exe
Resource
win10v20210408
Malware Config
Extracted
C:\MSOCache\How To Restore Your Files.txt
http://gtmx56k4hutn3ikv.onion/?JJ2Sdd8mtObS8tBQv5mM
http://gtmx56k4hutn3ikv.onion/
http://babukq4e2p4wu4iq.onion/login.php?id=UDFfRZirMNY2ENxMGJ9xczl3CTcie3
Targets
-
-
Target
84895601f472240234162ba7ac9a7b0952df8268c93f6ab385eeccb5aea7d120.sample
-
Size
40KB
-
MD5
de7c8dfe5e8050571ef394f0202edc82
-
SHA1
a03468953575a4730689d6d05558792150125ac8
-
SHA256
84895601f472240234162ba7ac9a7b0952df8268c93f6ab385eeccb5aea7d120
-
SHA512
874643de409b9c4e7fcb5c8727db3ab060a195b2411625e66c7e2fe5e03eecc5c21fd07e82f7edc38792a614f57e1a7e195d535057bec09cf256aafae9892bd4
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-