General
-
Target
tmp/d8deb2e4-3738-4789-875b-02797d524703_servspool.exe
-
Size
79KB
-
Sample
211216-19e8pachh4
-
MD5
643c8c25fbe8c3cc7576bc8e7bcd8a68
-
SHA1
5440796acedc3d0d847c8a812e5e647460ae3a27
-
SHA256
049e53f72c8afa5ccb850429d55a00e2fbe799e68247fd13f5058146cf0f4cf8
-
SHA512
d2042c4a908a53b59e52cc3ebf4c13fd7c537761de8fe33a65a664a055b13b6c58fbb482824e68764a09299affe1b592e72b6c846d8a65ddb1ace6a396bc371c
Static task
static1
Behavioral task
behavioral1
Sample
tmp/d8deb2e4-3738-4789-875b-02797d524703_servspool.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/d8deb2e4-3738-4789-875b-02797d524703_servspool.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\Restore Your Files.txt
1PbjpEYvCK7GCB4FmaZEewMjhT7N6rWnn2
Targets
-
-
Target
tmp/d8deb2e4-3738-4789-875b-02797d524703_servspool.exe
-
Size
79KB
-
MD5
643c8c25fbe8c3cc7576bc8e7bcd8a68
-
SHA1
5440796acedc3d0d847c8a812e5e647460ae3a27
-
SHA256
049e53f72c8afa5ccb850429d55a00e2fbe799e68247fd13f5058146cf0f4cf8
-
SHA512
d2042c4a908a53b59e52cc3ebf4c13fd7c537761de8fe33a65a664a055b13b6c58fbb482824e68764a09299affe1b592e72b6c846d8a65ddb1ace6a396bc371c
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-