General
-
Target
rook1.exe
-
Size
5.4MB
-
Sample
220111-w33m7agfg9
-
MD5
4f7adc32ec67c1a55853ef828fe58707
-
SHA1
36de7997949ac3b9b456023fb072b9a8cd84ade8
-
SHA256
96f7df1c984c1753289600f7f373f3a98a4f09f82acc1be8ecfd5790763a355b
-
SHA512
a45e4a20133c842037789157c3ed845afdefbb0d2fe3958d75f0cb3cdfeee106262f9de0e0aca92ac84a0211432cd19773e0f769b970ddb8a80e5f7855676f74
Static task
static1
Behavioral task
behavioral1
Sample
rook1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
rook1.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
rook1.exe
Resource
macos
Behavioral task
behavioral4
Sample
rook1.exe
Resource
ubuntu1804-amd64-en-20211208
Malware Config
Extracted
C:\HowToRestoreYourFiles.txt
rook
Targets
-
-
Target
rook1.exe
-
Size
5.4MB
-
MD5
4f7adc32ec67c1a55853ef828fe58707
-
SHA1
36de7997949ac3b9b456023fb072b9a8cd84ade8
-
SHA256
96f7df1c984c1753289600f7f373f3a98a4f09f82acc1be8ecfd5790763a355b
-
SHA512
a45e4a20133c842037789157c3ed845afdefbb0d2fe3958d75f0cb3cdfeee106262f9de0e0aca92ac84a0211432cd19773e0f769b970ddb8a80e5f7855676f74
Score10/10-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-