General
-
Target
485da83d711d4f9b1f968c7c7e62b30a9987e7cc5a961e5b92a4ab9fcb11611d
-
Size
386KB
-
Sample
220216-21kbqaebc5
-
MD5
910509a686df19980eb53da607dceddc
-
SHA1
f93539c26a99a46c85c40abcb0b3aaeb98c86ded
-
SHA256
485da83d711d4f9b1f968c7c7e62b30a9987e7cc5a961e5b92a4ab9fcb11611d
-
SHA512
aa45de4dc79dcb1fc5b8626ff134127661be5441b01563bf3550084f3d30971eb7c601776008781cccdc907f69ee5e3287f024701c1c340f88e820e6dc25afef
Static task
static1
Behavioral task
behavioral1
Sample
485da83d711d4f9b1f968c7c7e62b30a9987e7cc5a961e5b92a4ab9fcb11611d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
485da83d711d4f9b1f968c7c7e62b30a9987e7cc5a961e5b92a4ab9fcb11611d.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099cf5548199
https://mazedecrypt.top/892e099cf5548199
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c103c94c0
https://mazedecrypt.top/8802099c103c94c0
Targets
-
-
Target
485da83d711d4f9b1f968c7c7e62b30a9987e7cc5a961e5b92a4ab9fcb11611d
-
Size
386KB
-
MD5
910509a686df19980eb53da607dceddc
-
SHA1
f93539c26a99a46c85c40abcb0b3aaeb98c86ded
-
SHA256
485da83d711d4f9b1f968c7c7e62b30a9987e7cc5a961e5b92a4ab9fcb11611d
-
SHA512
aa45de4dc79dcb1fc5b8626ff134127661be5441b01563bf3550084f3d30971eb7c601776008781cccdc907f69ee5e3287f024701c1c340f88e820e6dc25afef
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-