General
-
Target
5f6cd6badb98e7fb6a9056b925e155b844073bbfbfe52e5576487440b1784b52
-
Size
1.1MB
-
Sample
220216-2xbv6seag3
-
MD5
68a2aaf9eaf66729bcce07371c9499c8
-
SHA1
19389573365a6de9788ffc637f56987acb87de8d
-
SHA256
5f6cd6badb98e7fb6a9056b925e155b844073bbfbfe52e5576487440b1784b52
-
SHA512
c8fa6c5b30a37b84e2965bade64ae390abc32a25df7c0149946751ac40d55015bd853c60a89b927cafeafe88443290ba4f8b9975951c741850cd3554521fea5e
Static task
static1
Behavioral task
behavioral1
Sample
5f6cd6badb98e7fb6a9056b925e155b844073bbfbfe52e5576487440b1784b52.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5f6cd6badb98e7fb6a9056b925e155b844073bbfbfe52e5576487440b1784b52.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8c3ba18be
https://mazedecrypt.top/6d570cc8c3ba18be
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc874dec3d6
https://mazedecrypt.top/6c2b0cc874dec3d6
Targets
-
-
Target
5f6cd6badb98e7fb6a9056b925e155b844073bbfbfe52e5576487440b1784b52
-
Size
1.1MB
-
MD5
68a2aaf9eaf66729bcce07371c9499c8
-
SHA1
19389573365a6de9788ffc637f56987acb87de8d
-
SHA256
5f6cd6badb98e7fb6a9056b925e155b844073bbfbfe52e5576487440b1784b52
-
SHA512
c8fa6c5b30a37b84e2965bade64ae390abc32a25df7c0149946751ac40d55015bd853c60a89b927cafeafe88443290ba4f8b9975951c741850cd3554521fea5e
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-