General
-
Target
cdcce11615f46852e81ddd770c55869bbc92befdf38d82024878f2e0520b5a2d
-
Size
751KB
-
Sample
220216-2knn7sfbap
-
MD5
46b98ee908d08f15137e509e5e69db1b
-
SHA1
73fbdd10619757fff0193b84fff54807e56afa58
-
SHA256
cdcce11615f46852e81ddd770c55869bbc92befdf38d82024878f2e0520b5a2d
-
SHA512
62cc5786d870ecf65aadd215efd73eb76455a3aaaa416b0ccd0eca5b4b0d0f39f5376a0228b209516ba9af6ce633646fc827e25f8dfe64a0566975f5eedfddbb
Static task
static1
Behavioral task
behavioral1
Sample
cdcce11615f46852e81ddd770c55869bbc92befdf38d82024878f2e0520b5a2d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
cdcce11615f46852e81ddd770c55869bbc92befdf38d82024878f2e0520b5a2d.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099c76d336a5
https://mazedecrypt.top/892e099c76d336a5
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c46bb5a79
https://mazedecrypt.top/8802099c46bb5a79
Targets
-
-
Target
cdcce11615f46852e81ddd770c55869bbc92befdf38d82024878f2e0520b5a2d
-
Size
751KB
-
MD5
46b98ee908d08f15137e509e5e69db1b
-
SHA1
73fbdd10619757fff0193b84fff54807e56afa58
-
SHA256
cdcce11615f46852e81ddd770c55869bbc92befdf38d82024878f2e0520b5a2d
-
SHA512
62cc5786d870ecf65aadd215efd73eb76455a3aaaa416b0ccd0eca5b4b0d0f39f5376a0228b209516ba9af6ce633646fc827e25f8dfe64a0566975f5eedfddbb
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-