General
-
Target
xxx.exe.virus
-
Size
416KB
-
Sample
220407-h33rashggq
-
MD5
23f82ce9f5f8e02614b31cc0810e0d5f
-
SHA1
0bbde5e6b3aefc33014ec3c1f1e61d8664a33a75
-
SHA256
206de75058a7dfa0b96784965baab63a137f2e89a97e623842e7d0bb3f12c2fc
-
SHA512
1231dc5046cb609b5cf2240a95cb728842048609a93d3034984948f9fe99ed54c508e154f3f7516f9b15a8244ec49574dc6d6ad4a95daa8ed6bcf8e4fbf4f52d
Static task
static1
Behavioral task
behavioral1
Sample
xxx.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
xxx.exe
Resource
win10v2004-20220310-en
Malware Config
Extracted
C:\HOW_TO_DECRYPT.txt
hive
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Extracted
C:\Users\Admin\AppData\Local\Temp\HOW_TO_DECRYPT.txt
hive
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Targets
-
-
Target
xxx.exe.virus
-
Size
416KB
-
MD5
23f82ce9f5f8e02614b31cc0810e0d5f
-
SHA1
0bbde5e6b3aefc33014ec3c1f1e61d8664a33a75
-
SHA256
206de75058a7dfa0b96784965baab63a137f2e89a97e623842e7d0bb3f12c2fc
-
SHA512
1231dc5046cb609b5cf2240a95cb728842048609a93d3034984948f9fe99ed54c508e154f3f7516f9b15a8244ec49574dc6d6ad4a95daa8ed6bcf8e4fbf4f52d
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-