General
-
Target
f5aaa96a1af8c7ebb2726109833da316f75f3917bf5e962fe8d8e6d906ac5e16
-
Size
592KB
-
Sample
220216-2gk4xadgh5
-
MD5
2b4576115b4c1ac7f457ab21e5ff6417
-
SHA1
963dce4df8be6bb4f254ab8c5820f4609c126071
-
SHA256
f5aaa96a1af8c7ebb2726109833da316f75f3917bf5e962fe8d8e6d906ac5e16
-
SHA512
d2623a527ad873dde9ae802ed0dd406f1aa5841dd4c6f6e145e4adb002e1d770fff36c234d96bf1c9a6ef57f6ec18d4572bc15e0f860f686cb0e325e3cb20e32
Static task
static1
Behavioral task
behavioral1
Sample
f5aaa96a1af8c7ebb2726109833da316f75f3917bf5e962fe8d8e6d906ac5e16.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f5aaa96a1af8c7ebb2726109833da316f75f3917bf5e962fe8d8e6d906ac5e16.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc89ebdedcd
https://mazedecrypt.top/6d570cc89ebdedcd
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc8e0bfe6b5
https://mazedecrypt.top/6c2b0cc8e0bfe6b5
Targets
-
-
Target
f5aaa96a1af8c7ebb2726109833da316f75f3917bf5e962fe8d8e6d906ac5e16
-
Size
592KB
-
MD5
2b4576115b4c1ac7f457ab21e5ff6417
-
SHA1
963dce4df8be6bb4f254ab8c5820f4609c126071
-
SHA256
f5aaa96a1af8c7ebb2726109833da316f75f3917bf5e962fe8d8e6d906ac5e16
-
SHA512
d2623a527ad873dde9ae802ed0dd406f1aa5841dd4c6f6e145e4adb002e1d770fff36c234d96bf1c9a6ef57f6ec18d4572bc15e0f860f686cb0e325e3cb20e32
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-