General
-
Target
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
Size
898KB
-
Sample
211020-leeakshgem
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
Static task
static1
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6bf70cb0d9f07dee
https://mazedecrypt.top/6bf70cb0d9f07dee
Targets
-
-
Target
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-