General
-
Target
eecd29254edb2ae64dd445b11236544b5fe33283f5177993d8aa18f1b05fc7d6
-
Size
593KB
-
Sample
220216-2gvy4sfagk
-
MD5
33f6a3a9130fb4b1670cedadc043bdb9
-
SHA1
1d67a3912b936d19d3e382c88c38e52084cba3e5
-
SHA256
eecd29254edb2ae64dd445b11236544b5fe33283f5177993d8aa18f1b05fc7d6
-
SHA512
7e76c6edd3cf948cbe583ad51d273c133f27967b35cab20397384e2e2e85b7c159310462d8a8100d4bf3f395934bf68f736b47eb1512a587c217dd5e5691bdc4
Static task
static1
Behavioral task
behavioral1
Sample
eecd29254edb2ae64dd445b11236544b5fe33283f5177993d8aa18f1b05fc7d6.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
eecd29254edb2ae64dd445b11236544b5fe33283f5177993d8aa18f1b05fc7d6.dll
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8526df1ee
https://mazedecrypt.top/6d570cc8526df1ee
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850caf41d7e8ad
https://mazedecrypt.top/6b850caf41d7e8ad
Targets
-
-
Target
eecd29254edb2ae64dd445b11236544b5fe33283f5177993d8aa18f1b05fc7d6
-
Size
593KB
-
MD5
33f6a3a9130fb4b1670cedadc043bdb9
-
SHA1
1d67a3912b936d19d3e382c88c38e52084cba3e5
-
SHA256
eecd29254edb2ae64dd445b11236544b5fe33283f5177993d8aa18f1b05fc7d6
-
SHA512
7e76c6edd3cf948cbe583ad51d273c133f27967b35cab20397384e2e2e85b7c159310462d8a8100d4bf3f395934bf68f736b47eb1512a587c217dd5e5691bdc4
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-