General
-
Target
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8
-
Size
69KB
-
Sample
220201-b1laxaeghq
-
MD5
412a0cf41cc1e85ac7ffdc0ccebd5475
-
SHA1
b86332d642d62fc945c015e3ae2f942a844ab948
-
SHA256
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8
-
SHA512
6830bc65ea37f5593b60923f37aab8e2aaea29230e110b44d45225361978253eb8a0066d73e3376cea69dc1d0af5b80c66c8e381dc2207041ae56836bcaa2c59
Static task
static1
Behavioral task
behavioral1
Sample
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\AD0D48-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Favorites\18EFE7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8
-
Size
69KB
-
MD5
412a0cf41cc1e85ac7ffdc0ccebd5475
-
SHA1
b86332d642d62fc945c015e3ae2f942a844ab948
-
SHA256
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8
-
SHA512
6830bc65ea37f5593b60923f37aab8e2aaea29230e110b44d45225361978253eb8a0066d73e3376cea69dc1d0af5b80c66c8e381dc2207041ae56836bcaa2c59
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-