General
-
Target
129a0f0f4dd667e3ecbcc252b890f306eb041ad0295cb1511343c307c12a658d
-
Size
5.1MB
-
Sample
220201-b1d7laeghn
-
MD5
25c0fde038e01fe84fd3df69c99e60a1
-
SHA1
147c1adc615daa93e84a5a9210ccc14ae86f6c55
-
SHA256
129a0f0f4dd667e3ecbcc252b890f306eb041ad0295cb1511343c307c12a658d
-
SHA512
8d666575c6570f5b128faf30d30f506259eda1907829bcf449c2407ea3aa943de46933bb3822b5fcddb25648ad8cc6f4d2077b29e82cdb4a6f423a5e1acc9fae
Static task
static1
Behavioral task
behavioral1
Sample
129a0f0f4dd667e3ecbcc252b890f306eb041ad0295cb1511343c307c12a658d.ps1
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
129a0f0f4dd667e3ecbcc252b890f306eb041ad0295cb1511343c307c12a658d.ps1
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\8E6C12-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
129a0f0f4dd667e3ecbcc252b890f306eb041ad0295cb1511343c307c12a658d
-
Size
5.1MB
-
MD5
25c0fde038e01fe84fd3df69c99e60a1
-
SHA1
147c1adc615daa93e84a5a9210ccc14ae86f6c55
-
SHA256
129a0f0f4dd667e3ecbcc252b890f306eb041ad0295cb1511343c307c12a658d
-
SHA512
8d666575c6570f5b128faf30d30f506259eda1907829bcf449c2407ea3aa943de46933bb3822b5fcddb25648ad8cc6f4d2077b29e82cdb4a6f423a5e1acc9fae
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies Installed Components in the registry
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-