General
-
Target
c040defb9c90074b489857f328d3e0040ac0ddab26cde132f17cccae7f1309cc
-
Size
789KB
-
Sample
220216-2lp9esfbbn
-
MD5
a0c5b4adbcd9eb6de9d32537b16c423b
-
SHA1
a243d4611bf442295ab2317d35158503d10e6dad
-
SHA256
c040defb9c90074b489857f328d3e0040ac0ddab26cde132f17cccae7f1309cc
-
SHA512
99c4858a99efdb7df1f5e3081423520b14d5c40d4107c3041b2753bc93b7e94ffd33581068949560484b66305ec49e4a3dd491400a13aad39023aa28c967de52
Static task
static1
Behavioral task
behavioral1
Sample
c040defb9c90074b489857f328d3e0040ac0ddab26cde132f17cccae7f1309cc.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c040defb9c90074b489857f328d3e0040ac0ddab26cde132f17cccae7f1309cc.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099c9ff77a70
https://mazedecrypt.top/892e099c9ff77a70
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/875c0983646d20d7
https://mazedecrypt.top/875c0983646d20d7
Targets
-
-
Target
c040defb9c90074b489857f328d3e0040ac0ddab26cde132f17cccae7f1309cc
-
Size
789KB
-
MD5
a0c5b4adbcd9eb6de9d32537b16c423b
-
SHA1
a243d4611bf442295ab2317d35158503d10e6dad
-
SHA256
c040defb9c90074b489857f328d3e0040ac0ddab26cde132f17cccae7f1309cc
-
SHA512
99c4858a99efdb7df1f5e3081423520b14d5c40d4107c3041b2753bc93b7e94ffd33581068949560484b66305ec49e4a3dd491400a13aad39023aa28c967de52
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-