General
-
Target
9678554995ddbcf42d562d43af6f50162703ea60a991594c0ac21b056afdc56f
-
Size
69KB
-
Sample
220201-btnsfsegal
-
MD5
d591354b8ebb378156ce4741d3191b3d
-
SHA1
5c6346e62370b37c7906b89d3016fd852c1fafbc
-
SHA256
9678554995ddbcf42d562d43af6f50162703ea60a991594c0ac21b056afdc56f
-
SHA512
8bcea489f592842c0bda0d45c9be2ac0972a928edd8f17fd0832cd95294c37f2d2a43d904433062d3bd5fcae989922d84db5e0725357a739d3e4071ccb001bbf
Static task
static1
Behavioral task
behavioral1
Sample
9678554995ddbcf42d562d43af6f50162703ea60a991594c0ac21b056afdc56f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9678554995ddbcf42d562d43af6f50162703ea60a991594c0ac21b056afdc56f.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\7781EE-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\09A823-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
9678554995ddbcf42d562d43af6f50162703ea60a991594c0ac21b056afdc56f
-
Size
69KB
-
MD5
d591354b8ebb378156ce4741d3191b3d
-
SHA1
5c6346e62370b37c7906b89d3016fd852c1fafbc
-
SHA256
9678554995ddbcf42d562d43af6f50162703ea60a991594c0ac21b056afdc56f
-
SHA512
8bcea489f592842c0bda0d45c9be2ac0972a928edd8f17fd0832cd95294c37f2d2a43d904433062d3bd5fcae989922d84db5e0725357a739d3e4071ccb001bbf
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-