General
-
Target
e1650d31f00d38b98cf8aa48a2e5fdd4bb30dd1177546abe3053bdcff25cefcc
-
Size
5.1MB
-
Sample
220201-bq4z9seffq
-
MD5
b49b3852097431b773e6dcf4c314f87a
-
SHA1
f0952ec5d3c90398e1335f1fad00b80dbd4c5a32
-
SHA256
e1650d31f00d38b98cf8aa48a2e5fdd4bb30dd1177546abe3053bdcff25cefcc
-
SHA512
0274aa4b490f226174fb5ea9f993ad38431438846313fde54682ef69a73fbebb26e51bf2f8b3e5fc604dab6e765765f5fd1d6f6bfefb928cb8a2f5ac33561291
Static task
static1
Behavioral task
behavioral1
Sample
e1650d31f00d38b98cf8aa48a2e5fdd4bb30dd1177546abe3053bdcff25cefcc.ps1
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e1650d31f00d38b98cf8aa48a2e5fdd4bb30dd1177546abe3053bdcff25cefcc.ps1
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\3C14B1-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
e1650d31f00d38b98cf8aa48a2e5fdd4bb30dd1177546abe3053bdcff25cefcc
-
Size
5.1MB
-
MD5
b49b3852097431b773e6dcf4c314f87a
-
SHA1
f0952ec5d3c90398e1335f1fad00b80dbd4c5a32
-
SHA256
e1650d31f00d38b98cf8aa48a2e5fdd4bb30dd1177546abe3053bdcff25cefcc
-
SHA512
0274aa4b490f226174fb5ea9f993ad38431438846313fde54682ef69a73fbebb26e51bf2f8b3e5fc604dab6e765765f5fd1d6f6bfefb928cb8a2f5ac33561291
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies Installed Components in the registry
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-