General
-
Target
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3
-
Size
758KB
-
Sample
220216-2wk3fseaf5
-
MD5
76166a976c7d3cf9c02dfa118574af10
-
SHA1
7c6cac9726fa19fa2f1fd33d58f915665a460fb8
-
SHA256
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3
-
SHA512
6d84a7701f4d118b656fec9d3d3a183f4b7e093ea923066877b9319fcfa2b18ad7fa29c254b0d4a4c1ba42cca9e90ca26296fb8f6e5a6d7a1d6bef0f78fc21bf
Static task
static1
Behavioral task
behavioral1
Sample
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc54de576e6
https://mazedecrypt.top/6c610cc54de576e6
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850caf9937d44d
https://mazedecrypt.top/6b850caf9937d44d
Targets
-
-
Target
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3
-
Size
758KB
-
MD5
76166a976c7d3cf9c02dfa118574af10
-
SHA1
7c6cac9726fa19fa2f1fd33d58f915665a460fb8
-
SHA256
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3
-
SHA512
6d84a7701f4d118b656fec9d3d3a183f4b7e093ea923066877b9319fcfa2b18ad7fa29c254b0d4a4c1ba42cca9e90ca26296fb8f6e5a6d7a1d6bef0f78fc21bf
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-