General
-
Target
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af
-
Size
478KB
-
Sample
220216-2v6mrseae8
-
MD5
deebbea18401e8b5e83c410c6d3a8b4e
-
SHA1
96d81e77b6af8f54a5ac07b2c613a5655dd05353
-
SHA256
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af
-
SHA512
a0396c82fb68cf3931f0a2fcdba580d51ec6069c82b4e3853341fc6971a4bde4dbeb0094b94379d1dce4b1d8c43703e86266156ecbee89f9c939a71cafe9d487
Static task
static1
Behavioral task
behavioral1
Sample
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/883809999aebd8c
https://mazedecrypt.top/883809999aebd8c
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c35cd74e5
https://mazedecrypt.top/8802099c35cd74e5
Targets
-
-
Target
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af
-
Size
478KB
-
MD5
deebbea18401e8b5e83c410c6d3a8b4e
-
SHA1
96d81e77b6af8f54a5ac07b2c613a5655dd05353
-
SHA256
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af
-
SHA512
a0396c82fb68cf3931f0a2fcdba580d51ec6069c82b4e3853341fc6971a4bde4dbeb0094b94379d1dce4b1d8c43703e86266156ecbee89f9c939a71cafe9d487
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Windows Defender anti-emulation file check
Defender's emulator always creates certain fake files which can be used to detect it.
-
Drops startup file
-