General
-
Target
4feb2e00c0dc0c42f42fd2c93f48e350c37386768e7774f82cdc98c8bc8dbc69
-
Size
354KB
-
Sample
220216-2zgjfaeba9
-
MD5
09e61348c89279d1f31159cc152a33ac
-
SHA1
1fc77fba10690bf81fa0b25ff1d74b23ff092d7e
-
SHA256
4feb2e00c0dc0c42f42fd2c93f48e350c37386768e7774f82cdc98c8bc8dbc69
-
SHA512
fdcdf8a50118f8cf2f379d755bdfc5c1c9c3ffa3fc333fc98ad9b24f4894763dfdb82c33e7edf6849b8c50c7b403f2a5ce64dd0935724c7cf9b973761ff237c7
Static task
static1
Behavioral task
behavioral1
Sample
4feb2e00c0dc0c42f42fd2c93f48e350c37386768e7774f82cdc98c8bc8dbc69.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4feb2e00c0dc0c42f42fd2c93f48e350c37386768e7774f82cdc98c8bc8dbc69.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/88380999473507da
https://mazedecrypt.top/88380999473507da
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c24db24c5
https://mazedecrypt.top/8802099c24db24c5
Targets
-
-
Target
4feb2e00c0dc0c42f42fd2c93f48e350c37386768e7774f82cdc98c8bc8dbc69
-
Size
354KB
-
MD5
09e61348c89279d1f31159cc152a33ac
-
SHA1
1fc77fba10690bf81fa0b25ff1d74b23ff092d7e
-
SHA256
4feb2e00c0dc0c42f42fd2c93f48e350c37386768e7774f82cdc98c8bc8dbc69
-
SHA512
fdcdf8a50118f8cf2f379d755bdfc5c1c9c3ffa3fc333fc98ad9b24f4894763dfdb82c33e7edf6849b8c50c7b403f2a5ce64dd0935724c7cf9b973761ff237c7
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-