General
-
Target
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18
-
Size
364KB
-
Sample
220216-2x79dafcek
-
MD5
d7d5907195cda040a984062294fcdbd5
-
SHA1
ba52267c305ff9bc6f02fa9c5ebcb690ccb267eb
-
SHA256
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18
-
SHA512
9871626b5f043583dc1f707386304d372a34734e03938d9f97d1ab3281be720ce3c1fed6b5bb78f5c24949fb6b18b5df8c57a456ac4c39bd7063579f1921b9b4
Static task
static1
Behavioral task
behavioral1
Sample
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8838099922a094c6
https://mazedecrypt.top/8838099922a094c6
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/875c0983f44a92f
https://mazedecrypt.top/875c0983f44a92f
Targets
-
-
Target
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18
-
Size
364KB
-
MD5
d7d5907195cda040a984062294fcdbd5
-
SHA1
ba52267c305ff9bc6f02fa9c5ebcb690ccb267eb
-
SHA256
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18
-
SHA512
9871626b5f043583dc1f707386304d372a34734e03938d9f97d1ab3281be720ce3c1fed6b5bb78f5c24949fb6b18b5df8c57a456ac4c39bd7063579f1921b9b4
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-