General
-
Target
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05
-
Size
591KB
-
Sample
220216-2re1msfbgr
-
MD5
140f6f9a6b3fb5c99b61c20afb6f39d7
-
SHA1
bb1136d16e8a203da7ed10426abd8fe475e7af97
-
SHA256
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05
-
SHA512
51a5bb962600d3574bcd9d1daa274a17950f8bff5365514eddc6f01c39a6b36247a29ab7c7fc84fa2b171c2fdc32f70c8dd28143edbc7172955b95043c9f2573
Static task
static1
Behavioral task
behavioral1
Sample
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8e2f48843
https://mazedecrypt.top/6d570cc8e2f48843
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc882a130b2
https://mazedecrypt.top/6c2b0cc882a130b2
Targets
-
-
Target
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05
-
Size
591KB
-
MD5
140f6f9a6b3fb5c99b61c20afb6f39d7
-
SHA1
bb1136d16e8a203da7ed10426abd8fe475e7af97
-
SHA256
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05
-
SHA512
51a5bb962600d3574bcd9d1daa274a17950f8bff5365514eddc6f01c39a6b36247a29ab7c7fc84fa2b171c2fdc32f70c8dd28143edbc7172955b95043c9f2573
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-