General
-
Target
d950a94534129202aa308f22d6c3d33f71af884d5556671a2b7f6ba8994cc995
-
Size
148KB
-
Sample
220201-bq65maeffr
-
MD5
8102821249e12bf3ab8c20163bb8ac0f
-
SHA1
c9414759d53bdce4326b04ac3f8ccd8d5441cb0c
-
SHA256
d950a94534129202aa308f22d6c3d33f71af884d5556671a2b7f6ba8994cc995
-
SHA512
c47ca0cf7da7a1ba64e14f94c080a50b50eb8efef5226f991e5290c57613b68c95a6890a6f9b476f8f9522482b3b0cc8ec5eff00d3b51c298c20a0a615055983
Static task
static1
Behavioral task
behavioral1
Sample
d950a94534129202aa308f22d6c3d33f71af884d5556671a2b7f6ba8994cc995.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d950a94534129202aa308f22d6c3d33f71af884d5556671a2b7f6ba8994cc995.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Users\Public\Libraries\3FD3C1-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
d950a94534129202aa308f22d6c3d33f71af884d5556671a2b7f6ba8994cc995
-
Size
148KB
-
MD5
8102821249e12bf3ab8c20163bb8ac0f
-
SHA1
c9414759d53bdce4326b04ac3f8ccd8d5441cb0c
-
SHA256
d950a94534129202aa308f22d6c3d33f71af884d5556671a2b7f6ba8994cc995
-
SHA512
c47ca0cf7da7a1ba64e14f94c080a50b50eb8efef5226f991e5290c57613b68c95a6890a6f9b476f8f9522482b3b0cc8ec5eff00d3b51c298c20a0a615055983
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-