General
-
Target
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b
-
Size
57KB
-
Sample
220201-b1jgbaeghp
-
MD5
45b39459e41bb09ed56e39fbcc7f2874
-
SHA1
07585e91f43cfce131769861fe81d075ee0d6673
-
SHA256
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b
-
SHA512
7732e41aace89cfbe1ee4deaf2f6b08ff627bec92cba651d920a33a4f0741afda2f72cffbc53cc0997e9846d39b800b8a649eba826393db554c586f97af1828c
Static task
static1
Behavioral task
behavioral1
Sample
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Users\Admin\0AD26D-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\D5F27E-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b
-
Size
57KB
-
MD5
45b39459e41bb09ed56e39fbcc7f2874
-
SHA1
07585e91f43cfce131769861fe81d075ee0d6673
-
SHA256
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b
-
SHA512
7732e41aace89cfbe1ee4deaf2f6b08ff627bec92cba651d920a33a4f0741afda2f72cffbc53cc0997e9846d39b800b8a649eba826393db554c586f97af1828c
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-