General
-
Target
667b5fc2edfd84a68093d717396be7fd323c11df63512cde3f4cefe8c2032a64
-
Size
69KB
-
Sample
220201-bw23vsfce5
-
MD5
de633ea14b251b2395da8411ff58cee5
-
SHA1
eee5bbcfcfccaca4374ef2a7a2358f45e3eb5599
-
SHA256
667b5fc2edfd84a68093d717396be7fd323c11df63512cde3f4cefe8c2032a64
-
SHA512
0ada356ce7a322dbc12e472899ecb66d071fc5ebba519bcfe121227650c2097f0fb53bde52ae34185586ba824decfdb4456da8bc86d4b52dcff38e868a338c1b
Static task
static1
Behavioral task
behavioral1
Sample
667b5fc2edfd84a68093d717396be7fd323c11df63512cde3f4cefe8c2032a64.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
667b5fc2edfd84a68093d717396be7fd323c11df63512cde3f4cefe8c2032a64.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\037D8D-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\.oracle_jre_usage\575659-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
667b5fc2edfd84a68093d717396be7fd323c11df63512cde3f4cefe8c2032a64
-
Size
69KB
-
MD5
de633ea14b251b2395da8411ff58cee5
-
SHA1
eee5bbcfcfccaca4374ef2a7a2358f45e3eb5599
-
SHA256
667b5fc2edfd84a68093d717396be7fd323c11df63512cde3f4cefe8c2032a64
-
SHA512
0ada356ce7a322dbc12e472899ecb66d071fc5ebba519bcfe121227650c2097f0fb53bde52ae34185586ba824decfdb4456da8bc86d4b52dcff38e868a338c1b
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-