General
-
Target
f491fb72f106e879021b0bb1149c4678fb380c255d2ef11ac4e0897378793f49
-
Size
480KB
-
Sample
220216-2gm89sdgh6
-
MD5
bf2e43ff8542e73c1b27291e0df06afd
-
SHA1
c542becdc2a6dd650c49f9e73adf9e32a998a62f
-
SHA256
f491fb72f106e879021b0bb1149c4678fb380c255d2ef11ac4e0897378793f49
-
SHA512
e26bccfd5052a153a87219c98cb4ac4ad3f74017febd4052eba55ac92852a132a33851d65e695de0a578c8d0cb5d1d17da831e75bff378dd2dab341a287dde99
Static task
static1
Behavioral task
behavioral1
Sample
f491fb72f106e879021b0bb1149c4678fb380c255d2ef11ac4e0897378793f49.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f491fb72f106e879021b0bb1149c4678fb380c255d2ef11ac4e0897378793f49.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099c637a5ae3
https://mazedecrypt.top/892e099c637a5ae3
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c541a2d68
https://mazedecrypt.top/8802099c541a2d68
Targets
-
-
Target
f491fb72f106e879021b0bb1149c4678fb380c255d2ef11ac4e0897378793f49
-
Size
480KB
-
MD5
bf2e43ff8542e73c1b27291e0df06afd
-
SHA1
c542becdc2a6dd650c49f9e73adf9e32a998a62f
-
SHA256
f491fb72f106e879021b0bb1149c4678fb380c255d2ef11ac4e0897378793f49
-
SHA512
e26bccfd5052a153a87219c98cb4ac4ad3f74017febd4052eba55ac92852a132a33851d65e695de0a578c8d0cb5d1d17da831e75bff378dd2dab341a287dde99
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-