General
-
Target
e_win.exe
-
Size
664KB
-
Sample
211116-t91fasbffl
-
MD5
2c1bacb056654515171bedadaecfe67e
-
SHA1
d45f9fccbb7c4c1221e3eb4d7801fa0a5910012e
-
SHA256
d81f751a2b47e3195fb035c804fc7a54d1c51426f759c53048bd9837663a101a
-
SHA512
79977a9fd287bc32072e74a45cc81e96351b6805e65c700df1be5e1e64a3c3f1db36830544418490896f88e630748d14c88bf86321a0f88ca50b3dffab57830a
Static task
static1
Behavioral task
behavioral1
Sample
e_win.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
e_win.exe
Resource
win10-en-20211104
Malware Config
Extracted
C:\Guide To Recover Your Files.txt
semenov.akkim@protonmail.com
chichihao@protonmail.com
velbms@rediffmail.com
sonuamit555@rediffmail.com
smenov@bitmessage.de
Targets
-
-
Target
e_win.exe
-
Size
664KB
-
MD5
2c1bacb056654515171bedadaecfe67e
-
SHA1
d45f9fccbb7c4c1221e3eb4d7801fa0a5910012e
-
SHA256
d81f751a2b47e3195fb035c804fc7a54d1c51426f759c53048bd9837663a101a
-
SHA512
79977a9fd287bc32072e74a45cc81e96351b6805e65c700df1be5e1e64a3c3f1db36830544418490896f88e630748d14c88bf86321a0f88ca50b3dffab57830a
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-