General
-
Target
4952e354ceccdaa13f6e7c14e287eca13433906a00e7c4dffd96c940327f74f0
-
Size
69KB
-
Sample
220201-bxwx8sfce8
-
MD5
d8298ad52aad8be92f2850cd1a8d2315
-
SHA1
db4934e34f8ec1568b8cce7708c99d554aca55e9
-
SHA256
4952e354ceccdaa13f6e7c14e287eca13433906a00e7c4dffd96c940327f74f0
-
SHA512
17e2cf682ac6ce4c55addab00f8bbc5aba7799478523abb45db2eef88fec5f2418a8e250a0d36184f57354ecc3d8875fdc48073dc8fc3c0d711162b36c6e3080
Static task
static1
Behavioral task
behavioral1
Sample
4952e354ceccdaa13f6e7c14e287eca13433906a00e7c4dffd96c940327f74f0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4952e354ceccdaa13f6e7c14e287eca13433906a00e7c4dffd96c940327f74f0.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\9051BE-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\B196C2-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
4952e354ceccdaa13f6e7c14e287eca13433906a00e7c4dffd96c940327f74f0
-
Size
69KB
-
MD5
d8298ad52aad8be92f2850cd1a8d2315
-
SHA1
db4934e34f8ec1568b8cce7708c99d554aca55e9
-
SHA256
4952e354ceccdaa13f6e7c14e287eca13433906a00e7c4dffd96c940327f74f0
-
SHA512
17e2cf682ac6ce4c55addab00f8bbc5aba7799478523abb45db2eef88fec5f2418a8e250a0d36184f57354ecc3d8875fdc48073dc8fc3c0d711162b36c6e3080
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-