General
-
Target
dee863ffa251717b8e56a96e2f9f0b41b09897d3c7cb2e8159fcb0ac0783611b.sample
-
Size
364KB
-
Sample
210726-z2x75kqc7j
-
MD5
c9ea6430da4e72b672ce29e56ecad603
-
SHA1
31c3f7b523e1e406d330958e28882227765c3c5e
-
SHA256
dee863ffa251717b8e56a96e2f9f0b41b09897d3c7cb2e8159fcb0ac0783611b
-
SHA512
4a7d30f1c8409299b9df27406fdcdabcdd834d292ebf27f8f0f7766d2a4b7b0cda12307f1d2a79bf1fdefee0bca6638057479ca301ebbb8d6638c0350ba8934e
Static task
static1
Behavioral task
behavioral1
Sample
dee863ffa251717b8e56a96e2f9f0b41b09897d3c7cb2e8159fcb0ac0783611b.sample.exe
Resource
win7v20210410
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/87fe099389251c5
https://mazedecrypt.top/87fe099389251c5
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/86ac0975f99fe2aa
https://mazedecrypt.top/86ac0975f99fe2aa
Targets
-
-
Target
dee863ffa251717b8e56a96e2f9f0b41b09897d3c7cb2e8159fcb0ac0783611b.sample
-
Size
364KB
-
MD5
c9ea6430da4e72b672ce29e56ecad603
-
SHA1
31c3f7b523e1e406d330958e28882227765c3c5e
-
SHA256
dee863ffa251717b8e56a96e2f9f0b41b09897d3c7cb2e8159fcb0ac0783611b
-
SHA512
4a7d30f1c8409299b9df27406fdcdabcdd834d292ebf27f8f0f7766d2a4b7b0cda12307f1d2a79bf1fdefee0bca6638057479ca301ebbb8d6638c0350ba8934e
-
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-