General
-
Target
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da
-
Size
366KB
-
Sample
220216-258vwafddj
-
MD5
2332f770b014f21bcc63c7bee50d543a
-
SHA1
21ef6f89c9604acdd15ec430343ada05640cb869
-
SHA256
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da
-
SHA512
294a23b72d0a0c19071e96c5e2743e54f959788e8e4c7fd1122bbed988460ddcf9ec063f604f1d6d98968d45c16ee237caac1a8641f8bd4c500e5e6d7fcd6d91
Static task
static1
Behavioral task
behavioral1
Sample
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5ebdfae1e
https://mazedecrypt.top/6c610cc5ebdfae1e
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850caf4a52b50d
https://mazedecrypt.top/6b850caf4a52b50d
Targets
-
-
Target
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da
-
Size
366KB
-
MD5
2332f770b014f21bcc63c7bee50d543a
-
SHA1
21ef6f89c9604acdd15ec430343ada05640cb869
-
SHA256
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da
-
SHA512
294a23b72d0a0c19071e96c5e2743e54f959788e8e4c7fd1122bbed988460ddcf9ec063f604f1d6d98968d45c16ee237caac1a8641f8bd4c500e5e6d7fcd6d91
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-