General
-
Target
153defee225de889d2ac66605f391f4aeaa8b867b4093c686941e64d0d245a57
-
Size
508KB
-
Sample
220216-25tqysfdcm
-
MD5
5df79164b6d0661277f11691121b1d53
-
SHA1
93d9565b2b40ae9e342a4e7e506e9a5694771868
-
SHA256
153defee225de889d2ac66605f391f4aeaa8b867b4093c686941e64d0d245a57
-
SHA512
6ac19e9891d2a3abb80d3c11fda6c5299a873f2e42c28866cca72a6a4d9d80ab099a6cd992085ced47c1e407255ecd30f97ebecb8b07b22051465229c48c43aa
Static task
static1
Behavioral task
behavioral1
Sample
153defee225de889d2ac66605f391f4aeaa8b867b4093c686941e64d0d245a57.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
153defee225de889d2ac66605f391f4aeaa8b867b4093c686941e64d0d245a57.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/883809995ae2d82b
https://mazedecrypt.top/883809995ae2d82b
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c6e0bfe8a
https://mazedecrypt.top/8802099c6e0bfe8a
Targets
-
-
Target
153defee225de889d2ac66605f391f4aeaa8b867b4093c686941e64d0d245a57
-
Size
508KB
-
MD5
5df79164b6d0661277f11691121b1d53
-
SHA1
93d9565b2b40ae9e342a4e7e506e9a5694771868
-
SHA256
153defee225de889d2ac66605f391f4aeaa8b867b4093c686941e64d0d245a57
-
SHA512
6ac19e9891d2a3abb80d3c11fda6c5299a873f2e42c28866cca72a6a4d9d80ab099a6cd992085ced47c1e407255ecd30f97ebecb8b07b22051465229c48c43aa
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-