General
-
Target
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0
-
Size
365KB
-
Sample
220216-24s32aebg4
-
MD5
ef95c48e750c1a3b1af8f5446fa04f54
-
SHA1
8ea5950ffefa2b7193a40682513e80a28d743175
-
SHA256
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0
-
SHA512
5d661b17bdfbbf40e5ead0cab9666ec94095d527d3d0c4b758670a00606f018867dc12d72cbf8e651db9c9f21849a88fe4666dff967bf436dfff8b2a574bc298
Static task
static1
Behavioral task
behavioral1
Sample
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099c951f85bc
https://mazedecrypt.top/892e099c951f85bc
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c8c199081
https://mazedecrypt.top/8802099c8c199081
Targets
-
-
Target
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0
-
Size
365KB
-
MD5
ef95c48e750c1a3b1af8f5446fa04f54
-
SHA1
8ea5950ffefa2b7193a40682513e80a28d743175
-
SHA256
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0
-
SHA512
5d661b17bdfbbf40e5ead0cab9666ec94095d527d3d0c4b758670a00606f018867dc12d72cbf8e651db9c9f21849a88fe4666dff967bf436dfff8b2a574bc298
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-