netwalker | 28f3d14de7356631cc6526b9df9f1539c71f6e3d7fcb1a5382f50bd1aecb0faf | Triage

Sharing

General

Target

28f3d14de7356631cc6526b9df9f1539c71f6e3d7fcb1a5382f50bd1aecb0faf
Size

65KB
MD5

284467b75c02f6f7f08b1ff792cd2542
SHA1

05d6978485745fe73ef3b624e39219bbcfa8c4c8
SHA256

28f3d14de7356631cc6526b9df9f1539c71f6e3d7fcb1a5382f50bd1aecb0faf
SHA512

dd7a6e67673ef4fe958edadfb33077feead06dfca3698923348c005ce51b6159bfd7692694dc17e0e99892ebce7494fdcb05f2772f4fd84416d834c16b1a7b29
SSDEEP

1536:pwX4BHaWAMfo5Kc3lBnXOU+hhOZuIW0C7RZiuxJNcvFMfQL:pdYSf0j3lxXxkhOZu10C7RhwvF

Score

10^/10

netwalker

Malware Config

Signatures

Detected Netwalker Ransomware 1 IoCs

Detected unpacked Netwalker executable.

resource	yara_rule
sample	netwalker_ransomware

Netwalker family
netwalker

Files

28f3d14de7356631cc6526b9df9f1539c71f6e3d7fcb1a5382f50bd1aecb0faf
.exe windows x86

e82dd51b077167be63c004bed23d0c1e

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ