General
-
Target
30b72e83d66cbe9e724c8e2b21179aecd4bcf68b2ec7895616807df380afab54
-
Size
463KB
-
Sample
220216-23xptsebf2
-
MD5
79d137d91be9819930eeb3876e4fbe79
-
SHA1
ac8ac79b8de3920f604d4d2a92a5adff3d2c8471
-
SHA256
30b72e83d66cbe9e724c8e2b21179aecd4bcf68b2ec7895616807df380afab54
-
SHA512
21480c5dacea52a6d9a6315914c170b3c5d44f20c6362b990d31f4bf5d599e8a28261fc6797fbf60256e2a17fa7a913f670cd8d3deb9b8a7b5bb6f746e6c9727
Static task
static1
Behavioral task
behavioral1
Sample
30b72e83d66cbe9e724c8e2b21179aecd4bcf68b2ec7895616807df380afab54.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
30b72e83d66cbe9e724c8e2b21179aecd4bcf68b2ec7895616807df380afab54.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/88380999ba8e496b
https://mazedecrypt.top/88380999ba8e496b
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/875c0983ab7e879a
https://mazedecrypt.top/875c0983ab7e879a
Targets
-
-
Target
30b72e83d66cbe9e724c8e2b21179aecd4bcf68b2ec7895616807df380afab54
-
Size
463KB
-
MD5
79d137d91be9819930eeb3876e4fbe79
-
SHA1
ac8ac79b8de3920f604d4d2a92a5adff3d2c8471
-
SHA256
30b72e83d66cbe9e724c8e2b21179aecd4bcf68b2ec7895616807df380afab54
-
SHA512
21480c5dacea52a6d9a6315914c170b3c5d44f20c6362b990d31f4bf5d599e8a28261fc6797fbf60256e2a17fa7a913f670cd8d3deb9b8a7b5bb6f746e6c9727
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-