General
-
Target
5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353
-
Size
479KB
-
Sample
220216-2xqz4afcdq
-
MD5
fba4cbb7167176990d5a8d24e9505f71
-
SHA1
aa6cd2698d4f9a7fa99f5807f4b6695a0bfd0124
-
SHA256
5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353
-
SHA512
bac75260a52e7501afb5e87340e68528c10cdc26d516ed5ac6bbc1a5a36162377edf9722eedfd1393b35ed87a77258e89db3c4097d95fadd24df13938f298b94
Static task
static1
Behavioral task
behavioral1
Sample
5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/892e099cce9028e5
https://mazedecrypt.top/892e099cce9028e5
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c27d42492
https://mazedecrypt.top/8802099c27d42492
Targets
-
-
Target
5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353
-
Size
479KB
-
MD5
fba4cbb7167176990d5a8d24e9505f71
-
SHA1
aa6cd2698d4f9a7fa99f5807f4b6695a0bfd0124
-
SHA256
5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353
-
SHA512
bac75260a52e7501afb5e87340e68528c10cdc26d516ed5ac6bbc1a5a36162377edf9722eedfd1393b35ed87a77258e89db3c4097d95fadd24df13938f298b94
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Windows Defender anti-emulation file check
Defender's emulator always creates certain fake files which can be used to detect it.
-
Drops startup file
-