General
-
Target
9be70b7fe15cd64aed5b1adc88c2d5270bce534d167c4a42d143ae0059c3da1c
-
Size
916KB
-
Sample
220216-2p6etafbfk
-
MD5
3bfcba2dd05e1c75f86c008f4d245f62
-
SHA1
fa37b947772eb8997a751f18fad9c1ca7f7f1151
-
SHA256
9be70b7fe15cd64aed5b1adc88c2d5270bce534d167c4a42d143ae0059c3da1c
-
SHA512
4fc4bcc05bee7c60c2385c8ad28acd0387f39ca89979e83f17e76043501a07f02dae1d517d16a5f79a6b880ff85a462950acc0aebdca9028cf57be7ed229d6b5
Static task
static1
Behavioral task
behavioral1
Sample
9be70b7fe15cd64aed5b1adc88c2d5270bce534d167c4a42d143ae0059c3da1c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9be70b7fe15cd64aed5b1adc88c2d5270bce534d167c4a42d143ae0059c3da1c.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099c2515824c
https://mazedecrypt.top/892e099c2515824c
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099ce54b4a02
https://mazedecrypt.top/8802099ce54b4a02
Targets
-
-
Target
9be70b7fe15cd64aed5b1adc88c2d5270bce534d167c4a42d143ae0059c3da1c
-
Size
916KB
-
MD5
3bfcba2dd05e1c75f86c008f4d245f62
-
SHA1
fa37b947772eb8997a751f18fad9c1ca7f7f1151
-
SHA256
9be70b7fe15cd64aed5b1adc88c2d5270bce534d167c4a42d143ae0059c3da1c
-
SHA512
4fc4bcc05bee7c60c2385c8ad28acd0387f39ca89979e83f17e76043501a07f02dae1d517d16a5f79a6b880ff85a462950acc0aebdca9028cf57be7ed229d6b5
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-