General
-
Target
d25kYWttd2thZAo.exe
-
Size
83KB
-
Sample
211212-qh67zsdedj
-
MD5
7ade88674690aa74970c12608b23bb30
-
SHA1
6522ee8ccc93ce3abec0a77a1732c15bb16a7ba0
-
SHA256
6eeb20cc709a18bf8845f7b678967b7f0ff96475cf51a261da87244886bbfd2e
-
SHA512
8849c9bfb8a7221c60ce1615e65e6af6c77739f1c5696a0d37ddcad374b8564e756373a20a27b5cb4f2c079b87111e26805bf857f22f57ce787f848a35522aca
Static task
static1
Behavioral task
behavioral1
Sample
d25kYWttd2thZAo.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d25kYWttd2thZAo.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\restore_file.txt
https://tox.chat
https://www.xmpp.jp
https://xmpp.org/software/clients/
Targets
-
-
Target
d25kYWttd2thZAo.exe
-
Size
83KB
-
MD5
7ade88674690aa74970c12608b23bb30
-
SHA1
6522ee8ccc93ce3abec0a77a1732c15bb16a7ba0
-
SHA256
6eeb20cc709a18bf8845f7b678967b7f0ff96475cf51a261da87244886bbfd2e
-
SHA512
8849c9bfb8a7221c60ce1615e65e6af6c77739f1c5696a0d37ddcad374b8564e756373a20a27b5cb4f2c079b87111e26805bf857f22f57ce787f848a35522aca
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-