General
-
Target
4539323319615488.zip
-
Size
15KB
-
Sample
210806-tg7vcyefns
-
MD5
a815951da2f98b305463d456c6fdc15e
-
SHA1
6b66d047d96408c0e21d56d8da67322a885f4672
-
SHA256
be238d5401b3ca702a8748885050afababfb4c509410838601f646c70c9d2283
-
SHA512
12a72e9b1b8fd73cf24f4f99a8803d4ecd163f769b1d49fa285005274458c042e05e1cce1741c448eb02cc7e89f85d62bdaba0be99a845b7c2f7b3524e6a7233
Static task
static1
Behavioral task
behavioral1
Sample
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02.exe
Resource
win10v20210408
Malware Config
Extracted
C:\MSOCache\How To Restore Your Files.txt
https://i.imgur.com/JZh2aDz.png
https://i.imgur.com/iKJ0m63.png
https://i.imgur.com/11DdeaB.png
https://i.imgur.com/9azjsKv.png
https://i.imgur.com/z6ry8kZ.png
https://i.imgur.com/tcryLE4.png
https://i.imgur.com/jruCjYx.png
https://i.imgur.com/vJJQxM1.png
http://babukq4e2p4wu4iq.onion/login.php?id=QQDgjfAG8pLYTBufjrVjnBg3iPAnSK
Targets
-
-
Target
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02
-
Size
31KB
-
MD5
e25e078255b56b47897ac96a7842de92
-
SHA1
21febfb36da69c8a611a9eaee5cc826cfd5684d7
-
SHA256
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02
-
SHA512
6ed5f9144996ad70ab9770ede191420ef12d69dd7833e0ec9064be0ec1959407c5971680e0a4bfc57a709853ea2d78c586a74f56f5d79874a5ab8f8adb45beb1
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-