General
-
Target
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample
-
Size
364KB
-
Sample
210726-y469kzzta2
-
MD5
b93616a1ea4f4a131cc0507e6c789f94
-
SHA1
0b97455143e682e818fc4a9b615f57349dc84894
-
SHA256
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d
-
SHA512
e6b8e4009ee946514c0a177838b1094b70fe84d8e4511e8ab9bca4180b0bf4cc5bf2ef563fb7efabd6cc91d758ed2e910f501081a72aaa9581d17ece780b70ad
Static task
static1
Behavioral task
behavioral1
Sample
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe
Resource
win7v20210408
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d050cd0bf5a78ff
https://mazedecrypt.top/6d050cd0bf5a78ff
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6ad50ca19ba4cb9c
https://mazedecrypt.top/6ad50ca19ba4cb9c
Targets
-
-
Target
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample
-
Size
364KB
-
MD5
b93616a1ea4f4a131cc0507e6c789f94
-
SHA1
0b97455143e682e818fc4a9b615f57349dc84894
-
SHA256
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d
-
SHA512
e6b8e4009ee946514c0a177838b1094b70fe84d8e4511e8ab9bca4180b0bf4cc5bf2ef563fb7efabd6cc91d758ed2e910f501081a72aaa9581d17ece780b70ad
-
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-