General
-
Target
e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b
-
Size
1.4MB
-
Sample
220201-dvb66agdh4
-
MD5
169b40c14d01ed0d87eecaf37fff9f8d
-
SHA1
84d5bec52b0c1b75e9ae33f6a1a049ffad2d5be3
-
SHA256
e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b
-
SHA512
d51194cd356ffd272ffae7021f619e041d7d0e18a1608c67f0cf23b93dd6b469a1909c71fc60ec1733c42d7d806931d789c38e5fc8f0a40719b280e84979bd75
Static task
static1
Behavioral task
behavioral1
Sample
e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Targets
-
-
Target
e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b
-
Size
1.4MB
-
MD5
169b40c14d01ed0d87eecaf37fff9f8d
-
SHA1
84d5bec52b0c1b75e9ae33f6a1a049ffad2d5be3
-
SHA256
e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b
-
SHA512
d51194cd356ffd272ffae7021f619e041d7d0e18a1608c67f0cf23b93dd6b469a1909c71fc60ec1733c42d7d806931d789c38e5fc8f0a40719b280e84979bd75
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Sets service image path in registry
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-