General
-
Target
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998
-
Size
593KB
-
Sample
220216-2ykjpsfcen
-
MD5
724bd2d25bfca6a5fc831250d352fe0a
-
SHA1
4db3b2c8ef3321192dc47f0cad72ca8a9702bbef
-
SHA256
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998
-
SHA512
430b113a440e3595234272720119093c4098bddcf98f8adfad9fba4f385d2e67bcc332fa749c0f3c77aecf2dc727d83a9cd9b6b639e4205359aceabeaa21c581
Static task
static1
Behavioral task
behavioral1
Sample
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998.dll
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5f1470002
https://mazedecrypt.top/6c610cc5f1470002
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850caf2c9139af
https://mazedecrypt.top/6b850caf2c9139af
Targets
-
-
Target
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998
-
Size
593KB
-
MD5
724bd2d25bfca6a5fc831250d352fe0a
-
SHA1
4db3b2c8ef3321192dc47f0cad72ca8a9702bbef
-
SHA256
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998
-
SHA512
430b113a440e3595234272720119093c4098bddcf98f8adfad9fba4f385d2e67bcc332fa749c0f3c77aecf2dc727d83a9cd9b6b639e4205359aceabeaa21c581
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-