General
-
Target
d6d98da42bc495153168a6e7fceeebb599f9ed3e3a95ca67c301a66b50f34bd2
-
Size
458KB
-
Sample
220201-k3mq7aced2
-
MD5
6099bbf0f6f85495929ddfc9b66d6992
-
SHA1
07849ba4d2d9cb2d13d40ceaf37965159a53c852
-
SHA256
d6d98da42bc495153168a6e7fceeebb599f9ed3e3a95ca67c301a66b50f34bd2
-
SHA512
3fd071ce5bc7cbfa3090ee260d57c7e98ae16f686396edb29d49cb254cbfb853adfd955e68bd98d4302b23e671c272b8ec76eaac8fae93c54224e6988a760378
Static task
static1
Behavioral task
behavioral1
Sample
d6d98da42bc495153168a6e7fceeebb599f9ed3e3a95ca67c301a66b50f34bd2.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d6d98da42bc495153168a6e7fceeebb599f9ed3e3a95ca67c301a66b50f34bd2.dll
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc841c57b83
https://mazedecrypt.top/6d570cc841c57b83
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850cafa14862fd
https://mazedecrypt.top/6b850cafa14862fd
Targets
-
-
Target
d6d98da42bc495153168a6e7fceeebb599f9ed3e3a95ca67c301a66b50f34bd2
-
Size
458KB
-
MD5
6099bbf0f6f85495929ddfc9b66d6992
-
SHA1
07849ba4d2d9cb2d13d40ceaf37965159a53c852
-
SHA256
d6d98da42bc495153168a6e7fceeebb599f9ed3e3a95ca67c301a66b50f34bd2
-
SHA512
3fd071ce5bc7cbfa3090ee260d57c7e98ae16f686396edb29d49cb254cbfb853adfd955e68bd98d4302b23e671c272b8ec76eaac8fae93c54224e6988a760378
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Sets service image path in registry
-
Drops startup file
-
Sets desktop wallpaper using registry
-