General
-
Target
3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3
-
Size
391KB
-
Sample
220216-226w4sebe4
-
MD5
a3753202df1ce12cf042107fa2a6c6db
-
SHA1
0f6e15c03673c3d60e61634fd1b1e62df3e1ce5a
-
SHA256
3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3
-
SHA512
3a52607aa8b9edfa5c77c814009f7ae3b0e3ea394fdd0d29548724808e0a65ceb0717704b4bfc5392420f4015a47753f20f18977564d25f2681fba743c68b21f
Static task
static1
Behavioral task
behavioral1
Sample
3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/88380999342c6eb9
https://mazedecrypt.top/88380999342c6eb9
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c59a08dfe
https://mazedecrypt.top/8802099c59a08dfe
Targets
-
-
Target
3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3
-
Size
391KB
-
MD5
a3753202df1ce12cf042107fa2a6c6db
-
SHA1
0f6e15c03673c3d60e61634fd1b1e62df3e1ce5a
-
SHA256
3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3
-
SHA512
3a52607aa8b9edfa5c77c814009f7ae3b0e3ea394fdd0d29548724808e0a65ceb0717704b4bfc5392420f4015a47753f20f18977564d25f2681fba743c68b21f
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-