General
-
Target
32736237e94a8321b4b03ba56485dff8b438cb232f2ff57c9c045f5cc7b5dc2b
-
Size
1.1MB
-
Sample
220216-23qlhsfdam
-
MD5
f457bb5060543db3146291d8c9ad1001
-
SHA1
c62d0b80847bf15ad0ab9b54b3ddc3180952c324
-
SHA256
32736237e94a8321b4b03ba56485dff8b438cb232f2ff57c9c045f5cc7b5dc2b
-
SHA512
70a9a7262d86b0ec85fe728317525ebfae2019a5b2bad4c6435fc5ec1659fe2bd730be79b2ff20e65dedd099bcf420c530023eef06f5c87529d951177c3ff408
Static task
static1
Behavioral task
behavioral1
Sample
32736237e94a8321b4b03ba56485dff8b438cb232f2ff57c9c045f5cc7b5dc2b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
32736237e94a8321b4b03ba56485dff8b438cb232f2ff57c9c045f5cc7b5dc2b.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc825b41879
https://mazedecrypt.top/6d570cc825b41879
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc88cfdc05e
https://mazedecrypt.top/6c2b0cc88cfdc05e
Targets
-
-
Target
32736237e94a8321b4b03ba56485dff8b438cb232f2ff57c9c045f5cc7b5dc2b
-
Size
1.1MB
-
MD5
f457bb5060543db3146291d8c9ad1001
-
SHA1
c62d0b80847bf15ad0ab9b54b3ddc3180952c324
-
SHA256
32736237e94a8321b4b03ba56485dff8b438cb232f2ff57c9c045f5cc7b5dc2b
-
SHA512
70a9a7262d86b0ec85fe728317525ebfae2019a5b2bad4c6435fc5ec1659fe2bd730be79b2ff20e65dedd099bcf420c530023eef06f5c87529d951177c3ff408
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-