General
-
Target
79a294ba27ab2b9ce227813ea9f02396e87838dcf7539167d5d6d9180fb0a26b
-
Size
593KB
-
Sample
220216-2tkc5seac8
-
MD5
27b6240febd31d1e5673bf756b3d826f
-
SHA1
00762f434a28eb9f452fcbdecd180ada8efafce4
-
SHA256
79a294ba27ab2b9ce227813ea9f02396e87838dcf7539167d5d6d9180fb0a26b
-
SHA512
45c58b22b25e394afb4c594551a961443aec7716e9ef61ca735a1650bec6661223fbc18e068453efb7a63831502ba08ea12f3105d8e31e79606b4faafd1963a9
Static task
static1
Behavioral task
behavioral1
Sample
79a294ba27ab2b9ce227813ea9f02396e87838dcf7539167d5d6d9180fb0a26b.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
79a294ba27ab2b9ce227813ea9f02396e87838dcf7539167d5d6d9180fb0a26b.dll
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8b6e99330
https://mazedecrypt.top/6d570cc8b6e99330
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850cafcc625796
https://mazedecrypt.top/6b850cafcc625796
Targets
-
-
Target
79a294ba27ab2b9ce227813ea9f02396e87838dcf7539167d5d6d9180fb0a26b
-
Size
593KB
-
MD5
27b6240febd31d1e5673bf756b3d826f
-
SHA1
00762f434a28eb9f452fcbdecd180ada8efafce4
-
SHA256
79a294ba27ab2b9ce227813ea9f02396e87838dcf7539167d5d6d9180fb0a26b
-
SHA512
45c58b22b25e394afb4c594551a961443aec7716e9ef61ca735a1650bec6661223fbc18e068453efb7a63831502ba08ea12f3105d8e31e79606b4faafd1963a9
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-