General
-
Target
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d
-
Size
1.1MB
-
Sample
220216-2gft7afafp
-
MD5
108a298b4ed5b4e77541061f32e55751
-
SHA1
6ab4f716180cc48855d65f77d4bdbd3d709a2f19
-
SHA256
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d
-
SHA512
ffb83a1042fe51776d0eb6db18bf269d4379963215b9508db8f0a7ad6897dbd86fb392daba542d6de4d85ab00a2a29c0557c7b28bb1d5434750bfbc49c9d0455
Static task
static1
Behavioral task
behavioral1
Sample
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8f54bd94e
https://mazedecrypt.top/6d570cc8f54bd94e
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc8d2465f11
https://mazedecrypt.top/6c2b0cc8d2465f11
Targets
-
-
Target
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d
-
Size
1.1MB
-
MD5
108a298b4ed5b4e77541061f32e55751
-
SHA1
6ab4f716180cc48855d65f77d4bdbd3d709a2f19
-
SHA256
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d
-
SHA512
ffb83a1042fe51776d0eb6db18bf269d4379963215b9508db8f0a7ad6897dbd86fb392daba542d6de4d85ab00a2a29c0557c7b28bb1d5434750bfbc49c9d0455
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-