General
-
Target
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd
-
Size
1.1MB
-
Sample
220216-24ynhsfdbl
-
MD5
8f6cff7e69cd66e3972f916c2d3c36cb
-
SHA1
83ccdc63d41a142702d6180db78b32b1cb7340f2
-
SHA256
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd
-
SHA512
5a9a115efe04b3637aa26089aa9d121bc907ae646c98e40b57d9900d195005197545368e5cdd4a706667aafb52799f47317872ae2557fbc076feed6a8b6e86d4
Static task
static1
Behavioral task
behavioral1
Sample
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe
Resource
win7-en-20211208
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc829e8d6ca
https://mazedecrypt.top/6d570cc829e8d6ca
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc844a48910
https://mazedecrypt.top/6c2b0cc844a48910
Targets
-
-
Target
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd
-
Size
1.1MB
-
MD5
8f6cff7e69cd66e3972f916c2d3c36cb
-
SHA1
83ccdc63d41a142702d6180db78b32b1cb7340f2
-
SHA256
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd
-
SHA512
5a9a115efe04b3637aa26089aa9d121bc907ae646c98e40b57d9900d195005197545368e5cdd4a706667aafb52799f47317872ae2557fbc076feed6a8b6e86d4
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-