General
-
Target
c1142340db4f1f423fc1cce14e657dd5861c9eb59788dec6d4c54ea227a437b9
-
Size
1.1MB
-
Sample
220216-2lfd8afbbl
-
MD5
a02c0a874f52cb3e29c1e3639e9c451b
-
SHA1
b97680618326582b01e57435dc04f0e93d94e6a7
-
SHA256
c1142340db4f1f423fc1cce14e657dd5861c9eb59788dec6d4c54ea227a437b9
-
SHA512
5da3eb618ea0f8eeb18a3db98639b74d9b091311c93623c65573f96ddb579018a358463a5a1229b8c950770472f1d1e5808a6db1f2769e0925f6ab42eb312573
Static task
static1
Behavioral task
behavioral1
Sample
c1142340db4f1f423fc1cce14e657dd5861c9eb59788dec6d4c54ea227a437b9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c1142340db4f1f423fc1cce14e657dd5861c9eb59788dec6d4c54ea227a437b9.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8cb3348b8
https://mazedecrypt.top/6d570cc8cb3348b8
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850caf92b98bb0
https://mazedecrypt.top/6b850caf92b98bb0
Targets
-
-
Target
c1142340db4f1f423fc1cce14e657dd5861c9eb59788dec6d4c54ea227a437b9
-
Size
1.1MB
-
MD5
a02c0a874f52cb3e29c1e3639e9c451b
-
SHA1
b97680618326582b01e57435dc04f0e93d94e6a7
-
SHA256
c1142340db4f1f423fc1cce14e657dd5861c9eb59788dec6d4c54ea227a437b9
-
SHA512
5da3eb618ea0f8eeb18a3db98639b74d9b091311c93623c65573f96ddb579018a358463a5a1229b8c950770472f1d1e5808a6db1f2769e0925f6ab42eb312573
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-