General
-
Target
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d
-
Size
80KB
-
Sample
220201-bzlkaaeggl
-
MD5
5cf25a50ae26c6c97a6ecd0e27b41541
-
SHA1
6e8d04cb4665ff7ad04d92e21d6b1791798639ac
-
SHA256
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d
-
SHA512
26758d1496a8ec616d9a490d839baeb4fd61ae1bfabf923c83f8bce1165e29449cbaaa2504b32bb6b68066c9b39eb7374c6ec09846770681d4b2f7738737a637
Static task
static1
Behavioral task
behavioral1
Sample
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0AD26D-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\5B361F-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d
-
Size
80KB
-
MD5
5cf25a50ae26c6c97a6ecd0e27b41541
-
SHA1
6e8d04cb4665ff7ad04d92e21d6b1791798639ac
-
SHA256
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d
-
SHA512
26758d1496a8ec616d9a490d839baeb4fd61ae1bfabf923c83f8bce1165e29449cbaaa2504b32bb6b68066c9b39eb7374c6ec09846770681d4b2f7738737a637
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-