General
-
Target
925e2f58599cfb91a03f516986676a206fc9af42000de106de6af32e9ba558bb
-
Size
345KB
-
Sample
220114-j9y75afbe4
-
MD5
5d40a2c6b936453af9895f17a78eee4f
-
SHA1
8df94028ed5b475b401489211d6757bdf545fbd4
-
SHA256
925e2f58599cfb91a03f516986676a206fc9af42000de106de6af32e9ba558bb
-
SHA512
5a803d4dca63df0f92a142480fa5fc64e7569fe081f4a7caec9c9bedb435886ed712cb483b12126c3f1733707cd569f3a1c7cbeffa20aa1de547dda2426092d9
Static task
static1
Behavioral task
behavioral1
Sample
925e2f58599cfb91a03f516986676a206fc9af42000de106de6af32e9ba558bb.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
925e2f58599cfb91a03f516986676a206fc9af42000de106de6af32e9ba558bb.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\HowToRestoreYourFiles.txt
rook
Targets
-
-
Target
925e2f58599cfb91a03f516986676a206fc9af42000de106de6af32e9ba558bb
-
Size
345KB
-
MD5
5d40a2c6b936453af9895f17a78eee4f
-
SHA1
8df94028ed5b475b401489211d6757bdf545fbd4
-
SHA256
925e2f58599cfb91a03f516986676a206fc9af42000de106de6af32e9ba558bb
-
SHA512
5a803d4dca63df0f92a142480fa5fc64e7569fe081f4a7caec9c9bedb435886ed712cb483b12126c3f1733707cd569f3a1c7cbeffa20aa1de547dda2426092d9
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-