General
-
Target
d728fb57f8f70fa1fe24c616c5c9ff72242b152bc85de1dbe1d46623b0556b1c
-
Size
462KB
-
Sample
220216-2jx69adhb9
-
MD5
d552be44a11d831e874e05cadafe04b6
-
SHA1
55462f391a8d0ece3d2649bf3fa4514a86679460
-
SHA256
d728fb57f8f70fa1fe24c616c5c9ff72242b152bc85de1dbe1d46623b0556b1c
-
SHA512
889ebc5b4e4b0ce1b4027e42dda5bd0c4c1e552b544bb56219a57936b3636006de518aca7e985ed2aee322788378e431d51bc9ba03cfe48e83d29e1a939b1272
Static task
static1
Behavioral task
behavioral1
Sample
d728fb57f8f70fa1fe24c616c5c9ff72242b152bc85de1dbe1d46623b0556b1c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d728fb57f8f70fa1fe24c616c5c9ff72242b152bc85de1dbe1d46623b0556b1c.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099c5d1070d5
https://mazedecrypt.top/892e099c5d1070d5
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/875c098370a426d3
https://mazedecrypt.top/875c098370a426d3
Targets
-
-
Target
d728fb57f8f70fa1fe24c616c5c9ff72242b152bc85de1dbe1d46623b0556b1c
-
Size
462KB
-
MD5
d552be44a11d831e874e05cadafe04b6
-
SHA1
55462f391a8d0ece3d2649bf3fa4514a86679460
-
SHA256
d728fb57f8f70fa1fe24c616c5c9ff72242b152bc85de1dbe1d46623b0556b1c
-
SHA512
889ebc5b4e4b0ce1b4027e42dda5bd0c4c1e552b544bb56219a57936b3636006de518aca7e985ed2aee322788378e431d51bc9ba03cfe48e83d29e1a939b1272
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-