General
-
Target
31d0f82a620738c929e8a088b5d3c884efa0350483a0f5af1ae80739fb6f547a
-
Size
69KB
-
Sample
220201-byncgsegfm
-
MD5
4343ea4f4eee159412243261ef9e2883
-
SHA1
7e3f802c345dc6a362d728fb388ff2938486cf28
-
SHA256
31d0f82a620738c929e8a088b5d3c884efa0350483a0f5af1ae80739fb6f547a
-
SHA512
c0062b4012867b7e38957f932e824e82898bcfd6a401eb7b409767ac69c03b7a033dcccb0dadf43261951ed958c79cd67c4f8c7b2208993e5d95f7e2f4a105cc
Static task
static1
Behavioral task
behavioral1
Sample
31d0f82a620738c929e8a088b5d3c884efa0350483a0f5af1ae80739fb6f547a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
31d0f82a620738c929e8a088b5d3c884efa0350483a0f5af1ae80739fb6f547a.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\Users\Public\Libraries\370311-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\35D5F9-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
31d0f82a620738c929e8a088b5d3c884efa0350483a0f5af1ae80739fb6f547a
-
Size
69KB
-
MD5
4343ea4f4eee159412243261ef9e2883
-
SHA1
7e3f802c345dc6a362d728fb388ff2938486cf28
-
SHA256
31d0f82a620738c929e8a088b5d3c884efa0350483a0f5af1ae80739fb6f547a
-
SHA512
c0062b4012867b7e38957f932e824e82898bcfd6a401eb7b409767ac69c03b7a033dcccb0dadf43261951ed958c79cd67c4f8c7b2208993e5d95f7e2f4a105cc
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-