General
-
Target
24da3ccf131b8236d3c4a8cc29482709531232ef9c9cba38266b908439dea063
-
Size
364KB
-
Sample
210831-5gm16kklfx
-
MD5
064058cf092063a5b69ed8fd2a1a04fe
-
SHA1
92b44e52f13bcb097f412a6a61bdc46ac19584c6
-
SHA256
24da3ccf131b8236d3c4a8cc29482709531232ef9c9cba38266b908439dea063
-
SHA512
19ed838eadbd23c17ec751cb4ed03059629f3fc64bc6225d23dc471a7c5b4d6223b9f27e5942a3dcff8776eef9b573bceb7748596d1715aaa23dbb614201e2af
Static task
static1
Behavioral task
behavioral1
Sample
24da3ccf131b8236d3c4a8cc29482709531232ef9c9cba38266b908439dea063.exe
Resource
win7v20210408
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d050cd0372cdf4f
https://mazedecrypt.top/6d050cd0372cdf4f
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6ad50ca1cd614942
https://mazedecrypt.top/6ad50ca1cd614942
Targets
-
-
Target
24da3ccf131b8236d3c4a8cc29482709531232ef9c9cba38266b908439dea063
-
Size
364KB
-
MD5
064058cf092063a5b69ed8fd2a1a04fe
-
SHA1
92b44e52f13bcb097f412a6a61bdc46ac19584c6
-
SHA256
24da3ccf131b8236d3c4a8cc29482709531232ef9c9cba38266b908439dea063
-
SHA512
19ed838eadbd23c17ec751cb4ed03059629f3fc64bc6225d23dc471a7c5b4d6223b9f27e5942a3dcff8776eef9b573bceb7748596d1715aaa23dbb614201e2af
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-