General
-
Target
9029a0acf20ac64175a0a30fd3d21ad858dacca021d424cf42a67bd1a27fc597
-
Size
399KB
-
Sample
220216-2rkacseaa5
-
MD5
72d5ded255dd69daf06eae70f97bc0a5
-
SHA1
a1dc2e2872abfcc3a7803d227da79c191e703f25
-
SHA256
9029a0acf20ac64175a0a30fd3d21ad858dacca021d424cf42a67bd1a27fc597
-
SHA512
121d8ccc7835583d36dd6955c0972ca72851528d8d1e668c999d06f19a92eab889114a633752a63fec5499120487e43b009964e620b62b7459088915eec50e4d
Static task
static1
Behavioral task
behavioral1
Sample
9029a0acf20ac64175a0a30fd3d21ad858dacca021d424cf42a67bd1a27fc597.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9029a0acf20ac64175a0a30fd3d21ad858dacca021d424cf42a67bd1a27fc597.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099cd68b4c98
https://mazedecrypt.top/892e099cd68b4c98
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099cee1d1277
https://mazedecrypt.top/8802099cee1d1277
Targets
-
-
Target
9029a0acf20ac64175a0a30fd3d21ad858dacca021d424cf42a67bd1a27fc597
-
Size
399KB
-
MD5
72d5ded255dd69daf06eae70f97bc0a5
-
SHA1
a1dc2e2872abfcc3a7803d227da79c191e703f25
-
SHA256
9029a0acf20ac64175a0a30fd3d21ad858dacca021d424cf42a67bd1a27fc597
-
SHA512
121d8ccc7835583d36dd6955c0972ca72851528d8d1e668c999d06f19a92eab889114a633752a63fec5499120487e43b009964e620b62b7459088915eec50e4d
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-