General
-
Target
99f9ffc5e0e9769e9be3c184b828ff8bf4d63cade2492aca281cf3f30891bac0.bin
-
Size
101KB
-
Sample
220101-vdzdssgcdq
-
MD5
ca6646d85b756664c2c1eb97a91bb8a1
-
SHA1
24b22ffbd61b3533a25fef787bacf3ecdca973ea
-
SHA256
99f9ffc5e0e9769e9be3c184b828ff8bf4d63cade2492aca281cf3f30891bac0
-
SHA512
d285f0c5a90d80615e74cfd228a221a629721051269078b49b696263c633623e3430aa1d1c1ad0c37454574eac1487641af895b1715bc64647bd08118b46310e
Static task
static1
Behavioral task
behavioral1
Sample
99f9ffc5e0e9769e9be3c184b828ff8bf4d63cade2492aca281cf3f30891bac0.bin.exe
Resource
win7-en-20211208
Malware Config
Extracted
C:\Users\Admin\Desktop\read_it.txt
18vhBpgPhZrjJkbuT2ZyUXAnJavaJcTwEd
https://www.coinmama.com
https://www.bitpanda.com
Extracted
C:\Users\Admin\Documents\AssertEdit.mht
ryuk
Targets
-
-
Target
99f9ffc5e0e9769e9be3c184b828ff8bf4d63cade2492aca281cf3f30891bac0.bin
-
Size
101KB
-
MD5
ca6646d85b756664c2c1eb97a91bb8a1
-
SHA1
24b22ffbd61b3533a25fef787bacf3ecdca973ea
-
SHA256
99f9ffc5e0e9769e9be3c184b828ff8bf4d63cade2492aca281cf3f30891bac0
-
SHA512
d285f0c5a90d80615e74cfd228a221a629721051269078b49b696263c633623e3430aa1d1c1ad0c37454574eac1487641af895b1715bc64647bd08118b46310e
-
Chaos Ransomware
-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-