General
-
Target
adf29a219ba2d948dd856ee7abaa51babaa30e11ad3ca56b58e66336c3c2369f
-
Size
69KB
-
Sample
220201-bs2b6afcb6
-
MD5
01f7032340473bfc2ee0ba47de9864fe
-
SHA1
70ad6a3c69bd014264258daf75f490cd2a513f0b
-
SHA256
adf29a219ba2d948dd856ee7abaa51babaa30e11ad3ca56b58e66336c3c2369f
-
SHA512
87f815d1fdfb5ec388e631746701f07972cb8139d5691894db3854d37734f940758a307d2fb18976e6fca0532ada055409b2c41732619d2e770a9f304c7f358c
Static task
static1
Behavioral task
behavioral1
Sample
adf29a219ba2d948dd856ee7abaa51babaa30e11ad3ca56b58e66336c3c2369f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
adf29a219ba2d948dd856ee7abaa51babaa30e11ad3ca56b58e66336c3c2369f.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\ProgramData\Microsoft\User Account Pictures\FBF266-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\C655BB-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
adf29a219ba2d948dd856ee7abaa51babaa30e11ad3ca56b58e66336c3c2369f
-
Size
69KB
-
MD5
01f7032340473bfc2ee0ba47de9864fe
-
SHA1
70ad6a3c69bd014264258daf75f490cd2a513f0b
-
SHA256
adf29a219ba2d948dd856ee7abaa51babaa30e11ad3ca56b58e66336c3c2369f
-
SHA512
87f815d1fdfb5ec388e631746701f07972cb8139d5691894db3854d37734f940758a307d2fb18976e6fca0532ada055409b2c41732619d2e770a9f304c7f358c
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Sets service image path in registry
-