General
-
Target
e35ffe111c62d9b05048518659b2b462d8124691bf63b8c34513ec4433d21d80
-
Size
359KB
-
Sample
220216-2hwxssdha9
-
MD5
89e1ddb8cc86c710ee068d6c6bf300f4
-
SHA1
6b4896a66dbecc1576434f25220cfa54015d1b9f
-
SHA256
e35ffe111c62d9b05048518659b2b462d8124691bf63b8c34513ec4433d21d80
-
SHA512
6d55f431d4081af6700c8717cd2529eddde551eae191cb2dbd31c9baec8a5f576b86affa73a305164aa7fdf7b8913d75d35b2a6e6d1ddc9ffede74a47a89a591
Static task
static1
Behavioral task
behavioral1
Sample
e35ffe111c62d9b05048518659b2b462d8124691bf63b8c34513ec4433d21d80.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e35ffe111c62d9b05048518659b2b462d8124691bf63b8c34513ec4433d21d80.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099cfec68267
https://mazedecrypt.top/892e099cfec68267
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/875c0983385fbd8f
https://mazedecrypt.top/875c0983385fbd8f
Targets
-
-
Target
e35ffe111c62d9b05048518659b2b462d8124691bf63b8c34513ec4433d21d80
-
Size
359KB
-
MD5
89e1ddb8cc86c710ee068d6c6bf300f4
-
SHA1
6b4896a66dbecc1576434f25220cfa54015d1b9f
-
SHA256
e35ffe111c62d9b05048518659b2b462d8124691bf63b8c34513ec4433d21d80
-
SHA512
6d55f431d4081af6700c8717cd2529eddde551eae191cb2dbd31c9baec8a5f576b86affa73a305164aa7fdf7b8913d75d35b2a6e6d1ddc9ffede74a47a89a591
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-