General
-
Target
543f72aaf9b4e0b2b5aa1dfb01ba9ee981f012bb1ea0029f2da35f3962b1f47b
-
Size
593KB
-
Sample
220216-2ypteseah9
-
MD5
1f248135b858fd13de23d69df2393010
-
SHA1
5665c4e9a9c5eaf7ab7d489699fc644c6127c5d3
-
SHA256
543f72aaf9b4e0b2b5aa1dfb01ba9ee981f012bb1ea0029f2da35f3962b1f47b
-
SHA512
4a7b82fff7543ad91c398ad50a908d3cf103edda7d3d409cc47368c5c02ff0609057b92d8a4dbeac9a41c3f6355b2a0789ea2bdd7548290da3008881341be1a2
Static task
static1
Behavioral task
behavioral1
Sample
543f72aaf9b4e0b2b5aa1dfb01ba9ee981f012bb1ea0029f2da35f3962b1f47b.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
543f72aaf9b4e0b2b5aa1dfb01ba9ee981f012bb1ea0029f2da35f3962b1f47b.dll
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5a3a975a8
https://mazedecrypt.top/6c610cc5a3a975a8
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b850caf7e9a7f18
https://mazedecrypt.top/6b850caf7e9a7f18
Targets
-
-
Target
543f72aaf9b4e0b2b5aa1dfb01ba9ee981f012bb1ea0029f2da35f3962b1f47b
-
Size
593KB
-
MD5
1f248135b858fd13de23d69df2393010
-
SHA1
5665c4e9a9c5eaf7ab7d489699fc644c6127c5d3
-
SHA256
543f72aaf9b4e0b2b5aa1dfb01ba9ee981f012bb1ea0029f2da35f3962b1f47b
-
SHA512
4a7b82fff7543ad91c398ad50a908d3cf103edda7d3d409cc47368c5c02ff0609057b92d8a4dbeac9a41c3f6355b2a0789ea2bdd7548290da3008881341be1a2
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-