General
-
Target
e9d2bc32a003fb158e9774cb25f1b6ff81aca9e9b2651eef80753fd64a8233f0
-
Size
593KB
-
Sample
220216-2g5tbafagp
-
MD5
c9fb5aed722e2d67c7a04a0a2430ba48
-
SHA1
7279577b33e84c333a225b35dc7f3e2fbe6524b5
-
SHA256
e9d2bc32a003fb158e9774cb25f1b6ff81aca9e9b2651eef80753fd64a8233f0
-
SHA512
993cbeff2ddc0107cb3569d2312bad6ad0bbb081c971f6120714e8189cfa099da3dc4248f14603d2da06f36289a3802a4554a3f4153c0463ad6f6405626154a8
Static task
static1
Behavioral task
behavioral1
Sample
e9d2bc32a003fb158e9774cb25f1b6ff81aca9e9b2651eef80753fd64a8233f0.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e9d2bc32a003fb158e9774cb25f1b6ff81aca9e9b2651eef80753fd64a8233f0.dll
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8b703956b
https://mazedecrypt.top/6d570cc8b703956b
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850caf95b0060d
https://mazedecrypt.top/6b850caf95b0060d
Targets
-
-
Target
e9d2bc32a003fb158e9774cb25f1b6ff81aca9e9b2651eef80753fd64a8233f0
-
Size
593KB
-
MD5
c9fb5aed722e2d67c7a04a0a2430ba48
-
SHA1
7279577b33e84c333a225b35dc7f3e2fbe6524b5
-
SHA256
e9d2bc32a003fb158e9774cb25f1b6ff81aca9e9b2651eef80753fd64a8233f0
-
SHA512
993cbeff2ddc0107cb3569d2312bad6ad0bbb081c971f6120714e8189cfa099da3dc4248f14603d2da06f36289a3802a4554a3f4153c0463ad6f6405626154a8
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-