General
-
Target
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56
-
Size
1.1MB
-
Sample
220216-2nz7eafbej
-
MD5
622fc2a2a3ff40714efeb318c6d528b1
-
SHA1
198a83f11b548695aa7b9736fdc8fa6b1527ba4c
-
SHA256
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56
-
SHA512
3c8b0979f4e3f8ebe97a82d120d5bb65d783304bfa88e82c76d8590ec53683b58aa5f7e3ec56ebe2e6a946268d0973c9f3c173979194fa57069194ebe180bd54
Static task
static1
Behavioral task
behavioral1
Sample
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8dd6b14c8
https://mazedecrypt.top/6d570cc8dd6b14c8
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850cafbb2e73dd
https://mazedecrypt.top/6b850cafbb2e73dd
Targets
-
-
Target
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56
-
Size
1.1MB
-
MD5
622fc2a2a3ff40714efeb318c6d528b1
-
SHA1
198a83f11b548695aa7b9736fdc8fa6b1527ba4c
-
SHA256
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56
-
SHA512
3c8b0979f4e3f8ebe97a82d120d5bb65d783304bfa88e82c76d8590ec53683b58aa5f7e3ec56ebe2e6a946268d0973c9f3c173979194fa57069194ebe180bd54
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-