General
-
Target
26a406f910570e67858db0eb713b135a98bb00856ba05cf8d4ad54233a9196a9
-
Size
57KB
-
Sample
220201-by72wsfcg4
-
MD5
5c26c665fc66b914e2e3d9114e23256f
-
SHA1
81dd2a490042854dbbc3cf3cfef47617c9933457
-
SHA256
26a406f910570e67858db0eb713b135a98bb00856ba05cf8d4ad54233a9196a9
-
SHA512
995b3ae4be60a5b51577d731910ef587d7ff8937e735b6615d15be7f48a8e5c8dbece0212c71ad61f5dfaaabb835add46114c482c3394d5c79ac81a9b74a30fb
Static task
static1
Behavioral task
behavioral1
Sample
26a406f910570e67858db0eb713b135a98bb00856ba05cf8d4ad54233a9196a9.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
26a406f910570e67858db0eb713b135a98bb00856ba05cf8d4ad54233a9196a9.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\7E950A-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\674123-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
26a406f910570e67858db0eb713b135a98bb00856ba05cf8d4ad54233a9196a9
-
Size
57KB
-
MD5
5c26c665fc66b914e2e3d9114e23256f
-
SHA1
81dd2a490042854dbbc3cf3cfef47617c9933457
-
SHA256
26a406f910570e67858db0eb713b135a98bb00856ba05cf8d4ad54233a9196a9
-
SHA512
995b3ae4be60a5b51577d731910ef587d7ff8937e735b6615d15be7f48a8e5c8dbece0212c71ad61f5dfaaabb835add46114c482c3394d5c79ac81a9b74a30fb
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-