General
-
Target
5378249a2b439e92691fb87751adc9fc4e2dea1792309d695b7f1d9c6887b09d.exe
-
Size
14KB
-
Sample
211024-eabwbsdaa2
-
MD5
a43ee303f6e4e6870036dad6666cbbd0
-
SHA1
95007b7c46858107378b9e444c83a772295fc6d9
-
SHA256
5378249a2b439e92691fb87751adc9fc4e2dea1792309d695b7f1d9c6887b09d
-
SHA512
78c216ba26fcf3d880c0a3485076fba48e02c4f309b452924214b5298b9582e9af41dc846e830dd5a2e00ef51870c40580920a7f6f020d627269c1ff543bf97c
Static task
static1
Behavioral task
behavioral1
Sample
5378249a2b439e92691fb87751adc9fc4e2dea1792309d695b7f1d9c6887b09d.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
5378249a2b439e92691fb87751adc9fc4e2dea1792309d695b7f1d9c6887b09d.exe
Resource
win10-en-20210920
Malware Config
Extracted
C:\Program Files\Java\jdk1.7.0_80\db\bin\#Decrypt#.txt
https://icq.com/windows/
https://icq.im/Whitehorsedecryption
Extracted
C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\#Decrypt#.txt
https://icq.com/windows/
https://icq.im/Whitehorsedecryption
Targets
-
-
Target
5378249a2b439e92691fb87751adc9fc4e2dea1792309d695b7f1d9c6887b09d.exe
-
Size
14KB
-
MD5
a43ee303f6e4e6870036dad6666cbbd0
-
SHA1
95007b7c46858107378b9e444c83a772295fc6d9
-
SHA256
5378249a2b439e92691fb87751adc9fc4e2dea1792309d695b7f1d9c6887b09d
-
SHA512
78c216ba26fcf3d880c0a3485076fba48e02c4f309b452924214b5298b9582e9af41dc846e830dd5a2e00ef51870c40580920a7f6f020d627269c1ff543bf97c
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Drops desktop.ini file(s)
-