General
-
Target
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9
-
Size
51KB
-
Sample
220211-ht6ftscah6
-
MD5
8c9419abb792b2a6d5220533fb221218
-
SHA1
34cf072cec588286ce5e13baf350239ead5ace8e
-
SHA256
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9
-
SHA512
3c44fcf8c91f7ef4059e3caebb31d309dec7bb3d8556079f495ccf308cb3f9e588aa1c8f8c705ce92cdf87a2bbc71ab256634950dcbba49474e2a6942e3a9a00
Static task
static1
Behavioral task
behavioral1
Sample
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\READ THIS.TXT
Extracted
C:\READ THIS.TXT
Targets
-
-
Target
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9
-
Size
51KB
-
MD5
8c9419abb792b2a6d5220533fb221218
-
SHA1
34cf072cec588286ce5e13baf350239ead5ace8e
-
SHA256
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9
-
SHA512
3c44fcf8c91f7ef4059e3caebb31d309dec7bb3d8556079f495ccf308cb3f9e588aa1c8f8c705ce92cdf87a2bbc71ab256634950dcbba49474e2a6942e3a9a00
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-