General
-
Target
4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d
-
Size
777KB
-
Sample
220216-22gxzsfchl
-
MD5
f5ecda7dd8bb1c514f93c09cea8ae00d
-
SHA1
f5e03c44b584367241cbd2152fbd99fcc9ccd43f
-
SHA256
4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d
-
SHA512
6ba2928825cced798d61cd1880525cbed4aeb79b04b4ec050e9657dfe06a95c7df3dc663dfc0f71c306af05a1dce1c764a27c4e0662719a7ba1f370af3aeb7d9
Static task
static1
Behavioral task
behavioral1
Sample
4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099c2d3816b3
https://mazedecrypt.top/892e099c2d3816b3
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/875c098346af9ba9
https://mazedecrypt.top/875c098346af9ba9
Targets
-
-
Target
4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d
-
Size
777KB
-
MD5
f5ecda7dd8bb1c514f93c09cea8ae00d
-
SHA1
f5e03c44b584367241cbd2152fbd99fcc9ccd43f
-
SHA256
4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d
-
SHA512
6ba2928825cced798d61cd1880525cbed4aeb79b04b4ec050e9657dfe06a95c7df3dc663dfc0f71c306af05a1dce1c764a27c4e0662719a7ba1f370af3aeb7d9
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-