General
-
Target
4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a
-
Size
601KB
-
Sample
220216-21198sfcgq
-
MD5
910aa49813ee4cc7e4fa0074db5e454a
-
SHA1
45831987fabeb7b32c70f662be8cb24e2efef1dc
-
SHA256
4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a
-
SHA512
3a726bda8119bbb45a5407703982453abca112df38921df76d57febd455c297f61c19858c40c48f155a721b460b0b5d4b410f5427980df3b8959f8969a8d24bd
Static task
static1
Behavioral task
behavioral1
Sample
4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8462f1985
https://mazedecrypt.top/6d570cc8462f1985
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc857407164
https://mazedecrypt.top/6c2b0cc857407164
Targets
-
-
Target
4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a
-
Size
601KB
-
MD5
910aa49813ee4cc7e4fa0074db5e454a
-
SHA1
45831987fabeb7b32c70f662be8cb24e2efef1dc
-
SHA256
4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a
-
SHA512
3a726bda8119bbb45a5407703982453abca112df38921df76d57febd455c297f61c19858c40c48f155a721b460b0b5d4b410f5427980df3b8959f8969a8d24bd
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-