General
-
Target
c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f
-
Size
106KB
-
Sample
211029-ph7cbaaabm
-
MD5
af745cf9bbc68f8652678a1299abb68d
-
SHA1
cd4793e42b0a27b2d73bc558d2d01842f73311e4
-
SHA256
c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f
-
SHA512
22fdaa9a782c1e3c08b0403dee317ccb441eec6c461a7b3372e184c557ba7721ab62412a161a9b33ee96fe4f8240ccc1f5142bfa76a14b2001b73a113ff018fd
Static task
static1
Behavioral task
behavioral1
Sample
c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f.exe
Resource
win10-en-20211014
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\decrypt_info.txt
Extracted
C:\Users\Admin\Desktop\decrypt_info.txt
Extracted
C:\Users\Admin\AppData\Local\Temp\decrypt_info.txt
Extracted
C:\Users\Admin\Desktop\decrypt_info.txt
Targets
-
-
Target
c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f
-
Size
106KB
-
MD5
af745cf9bbc68f8652678a1299abb68d
-
SHA1
cd4793e42b0a27b2d73bc558d2d01842f73311e4
-
SHA256
c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f
-
SHA512
22fdaa9a782c1e3c08b0403dee317ccb441eec6c461a7b3372e184c557ba7721ab62412a161a9b33ee96fe4f8240ccc1f5142bfa76a14b2001b73a113ff018fd
Score10/10-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Drops desktop.ini file(s)
-