General
-
Target
e45eacf5158bb2aa11f29f0675b4cb68dbf7e376569516fe33f84be524c67763
-
Size
365KB
-
Sample
220216-2htsfadha8
-
MD5
99743dd716d53c6b8962e1b9ff1d3a7a
-
SHA1
54a2b49a538ca07bf1b74c1ceab2b580b14d4450
-
SHA256
e45eacf5158bb2aa11f29f0675b4cb68dbf7e376569516fe33f84be524c67763
-
SHA512
842b0c3d2d15c4cb66cdd360e215676f2d68017ff96c51860879714959a474ace6c4e44ee3a629a1a3d004b88552d02005fd2530c849934a3c10dd076b173a4a
Static task
static1
Behavioral task
behavioral1
Sample
e45eacf5158bb2aa11f29f0675b4cb68dbf7e376569516fe33f84be524c67763.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e45eacf5158bb2aa11f29f0675b4cb68dbf7e376569516fe33f84be524c67763.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099cc2a93e2a
https://mazedecrypt.top/892e099cc2a93e2a
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/875c0983b9dad82
https://mazedecrypt.top/875c0983b9dad82
Targets
-
-
Target
e45eacf5158bb2aa11f29f0675b4cb68dbf7e376569516fe33f84be524c67763
-
Size
365KB
-
MD5
99743dd716d53c6b8962e1b9ff1d3a7a
-
SHA1
54a2b49a538ca07bf1b74c1ceab2b580b14d4450
-
SHA256
e45eacf5158bb2aa11f29f0675b4cb68dbf7e376569516fe33f84be524c67763
-
SHA512
842b0c3d2d15c4cb66cdd360e215676f2d68017ff96c51860879714959a474ace6c4e44ee3a629a1a3d004b88552d02005fd2530c849934a3c10dd076b173a4a
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-