General
-
Target
a1115fa0c74f51d35063f8d3caf1d49156ab78872c3723d5e585a4ee8e4f8370
-
Size
66KB
-
Sample
220201-btcp7aefhp
-
MD5
de0b8566636d87287d282b939a9368a5
-
SHA1
62a0a56ff1c97ada78dcf26d7cbda0fc5ebd173d
-
SHA256
a1115fa0c74f51d35063f8d3caf1d49156ab78872c3723d5e585a4ee8e4f8370
-
SHA512
c0d64ec594598af0c58317c161c0ee1ea5ebdc062bfa5c21028182625035f630529538cc016b8f2a15ebc3ccc6a3e26a7d058787d900dab40a92b06d27a0f7cb
Static task
static1
Behavioral task
behavioral1
Sample
a1115fa0c74f51d35063f8d3caf1d49156ab78872c3723d5e585a4ee8e4f8370.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a1115fa0c74f51d35063f8d3caf1d49156ab78872c3723d5e585a4ee8e4f8370.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\8F0853-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
a1115fa0c74f51d35063f8d3caf1d49156ab78872c3723d5e585a4ee8e4f8370
-
Size
66KB
-
MD5
de0b8566636d87287d282b939a9368a5
-
SHA1
62a0a56ff1c97ada78dcf26d7cbda0fc5ebd173d
-
SHA256
a1115fa0c74f51d35063f8d3caf1d49156ab78872c3723d5e585a4ee8e4f8370
-
SHA512
c0d64ec594598af0c58317c161c0ee1ea5ebdc062bfa5c21028182625035f630529538cc016b8f2a15ebc3ccc6a3e26a7d058787d900dab40a92b06d27a0f7cb
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Sets service image path in registry
-