General
-
Target
READS.exe
-
Size
53KB
-
Sample
210918-nkawfshcd7
-
MD5
9bd839a710177cf31625c09e321418ba
-
SHA1
82ebafbffb2ff94b91c037d5b51561d726ec32c5
-
SHA256
3e526ba55e9dc43928b592e879aa2ea896681e709a22c6b0b8911d6f264ed63c
-
SHA512
d3974db692f256f7733ccbf5d130bdcdcc18d18147b0522e8b0a3c10161604c1ee23e651cd132e3e61d81ff99c8af5a24abf465426aedc6dca1baa7adb53fc34
Static task
static1
Behavioral task
behavioral1
Sample
READS.exe
Resource
win7-en-20210916
Behavioral task
behavioral2
Sample
READS.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Admin\Desktop\how_to_back_files.html
medusalocker
Extracted
C:\Users\Admin\Desktop\how_to_back_files.html
medusalocker
Targets
-
-
Target
READS.exe
-
Size
53KB
-
MD5
9bd839a710177cf31625c09e321418ba
-
SHA1
82ebafbffb2ff94b91c037d5b51561d726ec32c5
-
SHA256
3e526ba55e9dc43928b592e879aa2ea896681e709a22c6b0b8911d6f264ed63c
-
SHA512
d3974db692f256f7733ccbf5d130bdcdcc18d18147b0522e8b0a3c10161604c1ee23e651cd132e3e61d81ff99c8af5a24abf465426aedc6dca1baa7adb53fc34
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-