General
-
Target
aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5
-
Size
65KB
-
Sample
220201-bs6a4sfcb7
-
MD5
5326329820103eddbd231b1898816204
-
SHA1
77557dd9115aa0be7b509b301a526a4234496e37
-
SHA256
aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5
-
SHA512
534de02ead299dcdec9cc1aac244a4afe6f1c1b891948aae62e1419c0242ddea9999d0885eb166c6b76a1a068a54ca9ebe3bb6ec239fa4c7348c6ac28b2b1af9
Static task
static1
Behavioral task
behavioral1
Sample
aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe
Resource
win7-en-20211208
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\DAC840-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5
-
Size
65KB
-
MD5
5326329820103eddbd231b1898816204
-
SHA1
77557dd9115aa0be7b509b301a526a4234496e37
-
SHA256
aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5
-
SHA512
534de02ead299dcdec9cc1aac244a4afe6f1c1b891948aae62e1419c0242ddea9999d0885eb166c6b76a1a068a54ca9ebe3bb6ec239fa4c7348c6ac28b2b1af9
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-