General
-
Target
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2
-
Size
1.1MB
-
Sample
220216-2jh3bsfahr
-
MD5
996360cdddfe5f6d6b868177fe5a3e1d
-
SHA1
35bff002183a579b816f99178150421671e53483
-
SHA256
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2
-
SHA512
983b93496ac27dd1d479fd991b568ff176aa0b3de170781d45e6e8db408253373597c9b78cc2547f460646863fa687c351222312f8858241ad1cf027f26da994
Static task
static1
Behavioral task
behavioral1
Sample
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc591536de
https://mazedecrypt.top/6c610cc591536de
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc8a878c8c5
https://mazedecrypt.top/6c2b0cc8a878c8c5
Targets
-
-
Target
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2
-
Size
1.1MB
-
MD5
996360cdddfe5f6d6b868177fe5a3e1d
-
SHA1
35bff002183a579b816f99178150421671e53483
-
SHA256
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2
-
SHA512
983b93496ac27dd1d479fd991b568ff176aa0b3de170781d45e6e8db408253373597c9b78cc2547f460646863fa687c351222312f8858241ad1cf027f26da994
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-