General
-
Target
0d0a6f525dac3a44e345f33700160dc5bf32ac95c84ca1871836f6857db63c40
-
Size
234KB
-
Sample
220216-265jvaeca3
-
MD5
3a1d69ce1197f5d70edc7b132ad1b682
-
SHA1
1bc34e2547c699c242e881d16f9373af9a310435
-
SHA256
0d0a6f525dac3a44e345f33700160dc5bf32ac95c84ca1871836f6857db63c40
-
SHA512
064269daca7379efceee6700af4a98fc8af93d9c90cbdcf4f4c75b252c61ef2e8f317a8dba3a0bae53b16886986fb7d21936937712b017d81c38cd3b1a5d3241
Static task
static1
Behavioral task
behavioral1
Sample
0d0a6f525dac3a44e345f33700160dc5bf32ac95c84ca1871836f6857db63c40.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0d0a6f525dac3a44e345f33700160dc5bf32ac95c84ca1871836f6857db63c40.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5f09d409
https://mazedecrypt.top/6c610cc5f09d409
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850caf9d78cc27
https://mazedecrypt.top/6b850caf9d78cc27
Targets
-
-
Target
0d0a6f525dac3a44e345f33700160dc5bf32ac95c84ca1871836f6857db63c40
-
Size
234KB
-
MD5
3a1d69ce1197f5d70edc7b132ad1b682
-
SHA1
1bc34e2547c699c242e881d16f9373af9a310435
-
SHA256
0d0a6f525dac3a44e345f33700160dc5bf32ac95c84ca1871836f6857db63c40
-
SHA512
064269daca7379efceee6700af4a98fc8af93d9c90cbdcf4f4c75b252c61ef2e8f317a8dba3a0bae53b16886986fb7d21936937712b017d81c38cd3b1a5d3241
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-