General
-
Target
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd
-
Size
1.0MB
-
Sample
220216-26znlafddq
-
MD5
be0e634d059c6d113b7874eb00daabbf
-
SHA1
4ba2a5d816f09e83b8b5dacb99bc26ee8ec0db46
-
SHA256
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd
-
SHA512
00bee8ab544be1643f894c2b1375a5b014eec4d85cfd5d630918e49fc815c332eddeec5f736719a40fbe0d28a49675851fccfff94a0353ac8c976ce2c3606be7
Static task
static1
Behavioral task
behavioral1
Sample
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe
Resource
win7-en-20211208
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8f79fbe35
https://mazedecrypt.top/6d570cc8f79fbe35
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc859273d0f
https://mazedecrypt.top/6c2b0cc859273d0f
Targets
-
-
Target
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd
-
Size
1.0MB
-
MD5
be0e634d059c6d113b7874eb00daabbf
-
SHA1
4ba2a5d816f09e83b8b5dacb99bc26ee8ec0db46
-
SHA256
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd
-
SHA512
00bee8ab544be1643f894c2b1375a5b014eec4d85cfd5d630918e49fc815c332eddeec5f736719a40fbe0d28a49675851fccfff94a0353ac8c976ce2c3606be7
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-