General
-
Target
d09c59de1d634faf6852ea9cbfa01d721c3f0a50da1fc2798acc0864409888f9
-
Size
1.5MB
-
Sample
210928-k9md1abdgj
-
MD5
4ff261f7dc9d374a864900ae19acdbac
-
SHA1
fd4e13b85a9f9b2c02c0af615bce1e30c278ecd7
-
SHA256
d09c59de1d634faf6852ea9cbfa01d721c3f0a50da1fc2798acc0864409888f9
-
SHA512
6b6c6025de0688adf427680af3399e314eea43b7259067219268b57a6e7277d7162337a4f77129e5e02e4803d6a4b1e3fa49e162a522f02a0964c0f27d3b7190
Static task
static1
Behavioral task
behavioral1
Sample
d09c59de1d634faf6852ea9cbfa01d721c3f0a50da1fc2798acc0864409888f9.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
d09c59de1d634faf6852ea9cbfa01d721c3f0a50da1fc2798acc0864409888f9.exe
Resource
win10-en-20210920
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Targets
-
-
Target
d09c59de1d634faf6852ea9cbfa01d721c3f0a50da1fc2798acc0864409888f9
-
Size
1.5MB
-
MD5
4ff261f7dc9d374a864900ae19acdbac
-
SHA1
fd4e13b85a9f9b2c02c0af615bce1e30c278ecd7
-
SHA256
d09c59de1d634faf6852ea9cbfa01d721c3f0a50da1fc2798acc0864409888f9
-
SHA512
6b6c6025de0688adf427680af3399e314eea43b7259067219268b57a6e7277d7162337a4f77129e5e02e4803d6a4b1e3fa49e162a522f02a0964c0f27d3b7190
-
Modifies Installed Components in the registry
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-