General
-
Target
04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e
-
Size
2.5MB
-
Sample
220216-27pj1sfden
-
MD5
54c9a5fc6149007e9b727fcccdafbbd4
-
SHA1
503f44e1634b7cfad812c7be2a15f0fe4d9a1b58
-
SHA256
04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e
-
SHA512
d79c19c5ce44881790abdb1caf654286ab8eefc5e7baf2c9ff13a58a97a004713015ba1539819ace212e505227e2b11e503c7bd14aeaab013bc77557bb02943e
Static task
static1
Behavioral task
behavioral1
Sample
04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099ca81afa11
https://mazedecrypt.top/892e099ca81afa11
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c16c7c49d
https://mazedecrypt.top/8802099c16c7c49d
Targets
-
-
Target
04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e
-
Size
2.5MB
-
MD5
54c9a5fc6149007e9b727fcccdafbbd4
-
SHA1
503f44e1634b7cfad812c7be2a15f0fe4d9a1b58
-
SHA256
04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e
-
SHA512
d79c19c5ce44881790abdb1caf654286ab8eefc5e7baf2c9ff13a58a97a004713015ba1539819ace212e505227e2b11e503c7bd14aeaab013bc77557bb02943e
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-