General
-
Target
4d98e0b246a514cf89ff635364fc157541be08641838cf238bd7ed91274739f3
-
Size
592KB
-
Sample
220216-2z6hkafcfr
-
MD5
8d90060c1cf2c468f89d2a856d657333
-
SHA1
6f332535573d4d14d92b5cb92068f1c595a9bdd4
-
SHA256
4d98e0b246a514cf89ff635364fc157541be08641838cf238bd7ed91274739f3
-
SHA512
4b9a3fe3488503f70f28abf04152c5014d6d1fdf7d831854bb419d77530f2785a355b61dbaa87d7b25c912b41d5880c49e6059726aab722504bb195e606b5c12
Static task
static1
Behavioral task
behavioral1
Sample
4d98e0b246a514cf89ff635364fc157541be08641838cf238bd7ed91274739f3.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4d98e0b246a514cf89ff635364fc157541be08641838cf238bd7ed91274739f3.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8d7c4a76
https://mazedecrypt.top/6d570cc8d7c4a76
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc872a76363
https://mazedecrypt.top/6c2b0cc872a76363
Targets
-
-
Target
4d98e0b246a514cf89ff635364fc157541be08641838cf238bd7ed91274739f3
-
Size
592KB
-
MD5
8d90060c1cf2c468f89d2a856d657333
-
SHA1
6f332535573d4d14d92b5cb92068f1c595a9bdd4
-
SHA256
4d98e0b246a514cf89ff635364fc157541be08641838cf238bd7ed91274739f3
-
SHA512
4b9a3fe3488503f70f28abf04152c5014d6d1fdf7d831854bb419d77530f2785a355b61dbaa87d7b25c912b41d5880c49e6059726aab722504bb195e606b5c12
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-