General
-
Target
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2
-
Size
364KB
-
Sample
220216-2nvlxsfbdq
-
MD5
8540030a0ea3e18e84af7ce026ab9cad
-
SHA1
4ccfe4cf5839024e768520c63e3a1982eee092f0
-
SHA256
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2
-
SHA512
8b7f32f3c4409cf3d5f69c32302c908086a4a156200fa3fb197bac957a0942a516349951633d09510b2f1c73bc02186f860467280cd36bbcebbdf1d0a974bb05
Static task
static1
Behavioral task
behavioral1
Sample
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8838099934d2f0d4
https://mazedecrypt.top/8838099934d2f0d4
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099cc2da0c76
https://mazedecrypt.top/8802099cc2da0c76
Targets
-
-
Target
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2
-
Size
364KB
-
MD5
8540030a0ea3e18e84af7ce026ab9cad
-
SHA1
4ccfe4cf5839024e768520c63e3a1982eee092f0
-
SHA256
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2
-
SHA512
8b7f32f3c4409cf3d5f69c32302c908086a4a156200fa3fb197bac957a0942a516349951633d09510b2f1c73bc02186f860467280cd36bbcebbdf1d0a974bb05
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-