General
-
Target
fb5de69b222d81fea2f4b08fd5af612faf24b9e75698ac331af066fbc360a30a
-
Size
591KB
-
Sample
220216-2f384afafk
-
MD5
c043c153237b334df2f2934f7640e802
-
SHA1
d5ef91b849122109615007329ec6548830f13bfc
-
SHA256
fb5de69b222d81fea2f4b08fd5af612faf24b9e75698ac331af066fbc360a30a
-
SHA512
e1a3005257891e496b42a2f6917e904e224e8b0efbf47f43e763e99e98f8d5766ec94cdae2184cf9fe7e0d539e5d25fd4f7dd7bb1009af6f7c897edd97087a77
Static task
static1
Behavioral task
behavioral1
Sample
fb5de69b222d81fea2f4b08fd5af612faf24b9e75698ac331af066fbc360a30a.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
fb5de69b222d81fea2f4b08fd5af612faf24b9e75698ac331af066fbc360a30a.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5397c1559
https://mazedecrypt.top/6c610cc5397c1559
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc8939b25d3
https://mazedecrypt.top/6c2b0cc8939b25d3
Targets
-
-
Target
fb5de69b222d81fea2f4b08fd5af612faf24b9e75698ac331af066fbc360a30a
-
Size
591KB
-
MD5
c043c153237b334df2f2934f7640e802
-
SHA1
d5ef91b849122109615007329ec6548830f13bfc
-
SHA256
fb5de69b222d81fea2f4b08fd5af612faf24b9e75698ac331af066fbc360a30a
-
SHA512
e1a3005257891e496b42a2f6917e904e224e8b0efbf47f43e763e99e98f8d5766ec94cdae2184cf9fe7e0d539e5d25fd4f7dd7bb1009af6f7c897edd97087a77
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-