General
-
Target
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b
-
Size
149KB
-
Sample
211102-s5c9jahccn
-
MD5
4e68455c60c1aa59b0c28808d6445e50
-
SHA1
7f58174891abc9b764d5cdd010078f107c1febb5
-
SHA256
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b
-
SHA512
3c0b92f3b567e4652f39d1bd71bfe630933af00a6d39cb0911e30915d34a00dac345d5042877237d849375855f22ead11d8c583495f3823b45cfbaef87ef5f69
Static task
static1
Behavioral task
behavioral1
Sample
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
Resource
win10-en-20211014
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Targets
-
-
Target
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b
-
Size
149KB
-
MD5
4e68455c60c1aa59b0c28808d6445e50
-
SHA1
7f58174891abc9b764d5cdd010078f107c1febb5
-
SHA256
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b
-
SHA512
3c0b92f3b567e4652f39d1bd71bfe630933af00a6d39cb0911e30915d34a00dac345d5042877237d849375855f22ead11d8c583495f3823b45cfbaef87ef5f69
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Modifies WinLogon
-