General
-
Target
enc.exe
-
Size
156KB
-
Sample
220121-nhqtwscgbj
-
MD5
14ee62fcc9163509856671400429ad55
-
SHA1
7544332b52769ca853d900669ef5e272a2ae1665
-
SHA256
699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd
-
SHA512
4d71c87be6f6ad7c9f3277b60850cd7136cecfd5f15621d1e56b1897008da8cc742578112ea955f8417c8d4cf13bcfb92e7ceafb34720017b47d81c4d2603bff
Static task
static1
Behavioral task
behavioral1
Sample
enc.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
enc.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\Documents and Settings\WANNA_RECOVER_KOXIC_FILEZ_GWOFW.txt
https://tox.chat/download.html
https://github.com/qTox/qTox/releases/download/v1.17.3/setup-qtox-x86_64-release.exe
Extracted
C:\Documents and Settings\WANNA_RECOVER_KOXIC_FILEZ_MRTTA.txt
https://tox.chat/download.html
https://github.com/qTox/qTox/releases/download/v1.17.3/setup-qtox-x86_64-release.exe
Targets
-
-
Target
enc.exe
-
Size
156KB
-
MD5
14ee62fcc9163509856671400429ad55
-
SHA1
7544332b52769ca853d900669ef5e272a2ae1665
-
SHA256
699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd
-
SHA512
4d71c87be6f6ad7c9f3277b60850cd7136cecfd5f15621d1e56b1897008da8cc742578112ea955f8417c8d4cf13bcfb92e7ceafb34720017b47d81c4d2603bff
Score10/10-
Disables taskbar notifications via registry modification
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-