General
-
Target
91424ac700abaf7d7a690bdeaba2f670c8383f11f15b2b412a52ec4260a12dc1
-
Size
364KB
-
Sample
220216-2rcwaaeaa3
-
MD5
545bd3bec00aaa561c63c1dbc666d1ed
-
SHA1
b97ef6dac862b082cb9ddd31c08d028f7cc9f54f
-
SHA256
91424ac700abaf7d7a690bdeaba2f670c8383f11f15b2b412a52ec4260a12dc1
-
SHA512
d6c86f53b7f65eb84afae5dcc509563dff0d68376f0cded1a6794e40180539244cf9a49a5c07e29372bf5dab0c988b63620490187605dc3d83757bbdb71e93c8
Static task
static1
Behavioral task
behavioral1
Sample
91424ac700abaf7d7a690bdeaba2f670c8383f11f15b2b412a52ec4260a12dc1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
91424ac700abaf7d7a690bdeaba2f670c8383f11f15b2b412a52ec4260a12dc1.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8343db19a
https://mazedecrypt.top/6d570cc8343db19a
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc8943e9c33
https://mazedecrypt.top/6c2b0cc8943e9c33
Targets
-
-
Target
91424ac700abaf7d7a690bdeaba2f670c8383f11f15b2b412a52ec4260a12dc1
-
Size
364KB
-
MD5
545bd3bec00aaa561c63c1dbc666d1ed
-
SHA1
b97ef6dac862b082cb9ddd31c08d028f7cc9f54f
-
SHA256
91424ac700abaf7d7a690bdeaba2f670c8383f11f15b2b412a52ec4260a12dc1
-
SHA512
d6c86f53b7f65eb84afae5dcc509563dff0d68376f0cded1a6794e40180539244cf9a49a5c07e29372bf5dab0c988b63620490187605dc3d83757bbdb71e93c8
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-