General
-
Target
6fcdd8a2702c1102362771912e75b76ffada9a30ad0683cdf489bac59fb3526b
-
Size
50KB
-
Sample
220211-hk9f5abhh9
-
MD5
5d71aa0ad68d1240aba04f1a9f3a6191
-
SHA1
5b534dcf9ac7497db5f943adff3af31aae1fa48d
-
SHA256
6fcdd8a2702c1102362771912e75b76ffada9a30ad0683cdf489bac59fb3526b
-
SHA512
9e71182f59aee6a34ccdc8ef7e930f7fa25f019d45efe7dbb6d45cd50d3384b42d59c3b1e249f5da7727be616ae2381887b3ad917ef546c8997c2476cc94ed36
Static task
static1
Behavioral task
behavioral1
Sample
6fcdd8a2702c1102362771912e75b76ffada9a30ad0683cdf489bac59fb3526b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6fcdd8a2702c1102362771912e75b76ffada9a30ad0683cdf489bac59fb3526b.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\HOW_TO_BACK_FILES.txt
Extracted
C:\HOW_TO_BACK_FILES.txt
Targets
-
-
Target
6fcdd8a2702c1102362771912e75b76ffada9a30ad0683cdf489bac59fb3526b
-
Size
50KB
-
MD5
5d71aa0ad68d1240aba04f1a9f3a6191
-
SHA1
5b534dcf9ac7497db5f943adff3af31aae1fa48d
-
SHA256
6fcdd8a2702c1102362771912e75b76ffada9a30ad0683cdf489bac59fb3526b
-
SHA512
9e71182f59aee6a34ccdc8ef7e930f7fa25f019d45efe7dbb6d45cd50d3384b42d59c3b1e249f5da7727be616ae2381887b3ad917ef546c8997c2476cc94ed36
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-