General
-
Target
195ef8cfabc2e877ebb1a60a19850c714fb0a477592b0a8d61d88f0f96be5de9
-
Size
727KB
-
Sample
220216-25j7hsfdck
-
MD5
27c5ecbb94b84c315d56673a851b6cf9
-
SHA1
326f4984644aac4370c8237984fd369f1c9db29b
-
SHA256
195ef8cfabc2e877ebb1a60a19850c714fb0a477592b0a8d61d88f0f96be5de9
-
SHA512
7a811abc5bc380eab6fd3e447e858c382edfba1e5088cb66065df4c393e9cc01b37bbd875b3de173fabc72f6055467e80a6a8a1b7eb8744d1a40b58877d86b32
Static task
static1
Behavioral task
behavioral1
Sample
195ef8cfabc2e877ebb1a60a19850c714fb0a477592b0a8d61d88f0f96be5de9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
195ef8cfabc2e877ebb1a60a19850c714fb0a477592b0a8d61d88f0f96be5de9.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099c398b21b2
https://mazedecrypt.top/892e099c398b21b2
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099cdefd5cde
https://mazedecrypt.top/8802099cdefd5cde
Targets
-
-
Target
195ef8cfabc2e877ebb1a60a19850c714fb0a477592b0a8d61d88f0f96be5de9
-
Size
727KB
-
MD5
27c5ecbb94b84c315d56673a851b6cf9
-
SHA1
326f4984644aac4370c8237984fd369f1c9db29b
-
SHA256
195ef8cfabc2e877ebb1a60a19850c714fb0a477592b0a8d61d88f0f96be5de9
-
SHA512
7a811abc5bc380eab6fd3e447e858c382edfba1e5088cb66065df4c393e9cc01b37bbd875b3de173fabc72f6055467e80a6a8a1b7eb8744d1a40b58877d86b32
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-