General
-
Target
d6eac8db484a1ac3530801606efec34c4d1a52fc66aabc3bab45bc3f0bcc3439
-
Size
57KB
-
Sample
220201-brc8yaefgk
-
MD5
73428d129222a3b16990ff1dbe154d91
-
SHA1
c52e0db970b60aff3833afd5e82696646ff5d135
-
SHA256
d6eac8db484a1ac3530801606efec34c4d1a52fc66aabc3bab45bc3f0bcc3439
-
SHA512
66ce4b067ae0a5a5f18166895be120122bb5f3d7a8342a17b49666817a7bef3fb2e1f902bb8de3531000844a4ba63cfacb77bd97cc4e27343b7182e15650bff6
Static task
static1
Behavioral task
behavioral1
Sample
d6eac8db484a1ac3530801606efec34c4d1a52fc66aabc3bab45bc3f0bcc3439.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d6eac8db484a1ac3530801606efec34c4d1a52fc66aabc3bab45bc3f0bcc3439.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\74E80A-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
d6eac8db484a1ac3530801606efec34c4d1a52fc66aabc3bab45bc3f0bcc3439
-
Size
57KB
-
MD5
73428d129222a3b16990ff1dbe154d91
-
SHA1
c52e0db970b60aff3833afd5e82696646ff5d135
-
SHA256
d6eac8db484a1ac3530801606efec34c4d1a52fc66aabc3bab45bc3f0bcc3439
-
SHA512
66ce4b067ae0a5a5f18166895be120122bb5f3d7a8342a17b49666817a7bef3fb2e1f902bb8de3531000844a4ba63cfacb77bd97cc4e27343b7182e15650bff6
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-