General
-
Target
278f0dcb42837dbe078cd80057d9d6541d6f82e0163495425fd6716965b20b39
-
Size
57KB
-
Sample
220201-by26msegfq
-
MD5
59efb6774ad0b6ee41184e49e7f14c1e
-
SHA1
7cde3ed8f0b731044783d40481fe9cc892c8f978
-
SHA256
278f0dcb42837dbe078cd80057d9d6541d6f82e0163495425fd6716965b20b39
-
SHA512
836e7ad821eca323e815ad26060cc6f903993856f506869d2ecb667c6bc888ad0a42aa0676dea5f5af0eb8b8701788ba99d78f119a686e6f05d7ff73a896564b
Static task
static1
Behavioral task
behavioral1
Sample
278f0dcb42837dbe078cd80057d9d6541d6f82e0163495425fd6716965b20b39.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
278f0dcb42837dbe078cd80057d9d6541d6f82e0163495425fd6716965b20b39.dll
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\Program Files\Microsoft Office\Office14\B9DDA2-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\5B361F-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
278f0dcb42837dbe078cd80057d9d6541d6f82e0163495425fd6716965b20b39
-
Size
57KB
-
MD5
59efb6774ad0b6ee41184e49e7f14c1e
-
SHA1
7cde3ed8f0b731044783d40481fe9cc892c8f978
-
SHA256
278f0dcb42837dbe078cd80057d9d6541d6f82e0163495425fd6716965b20b39
-
SHA512
836e7ad821eca323e815ad26060cc6f903993856f506869d2ecb667c6bc888ad0a42aa0676dea5f5af0eb8b8701788ba99d78f119a686e6f05d7ff73a896564b
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-