Overview

overview

10

Static

static

sample.exe

windows7_x64

10

sample.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    25835a890a218fd26bfd8b23696576402b5eb8a4c9af4a51529e14c4f00a9cce.bin.sample.gz
  • Size 29KB
  • Sample220415-phdp1acaa2
  • SHA256 7159a202d1129ee4685bc305f4c5a1b8ce664a129257af0a95acadc9b22b23d4
  • MD5 SHA1 SHA512
Score
10/10
ransomware

Malware Config

Extracted

Path

  • C:\How To Decrypt.txt

Ransom Note
  • Blaze Ransomware Your data are stolen and encrypted The data will be published on TOR website http://imugmohnfb6akqz7jb6rqjusiwgnthjgm37mjygondgkwwyw3hwudkqd.onion if you do not pay the ransom You can contact us and decrypt one file for free. [email protected] Caution!! Do not modify encrypted files, otherwise you may lose all your files forever!
URLs

  • http://imugmohnfb6akqz7jb6rqjusiwgnthjgm37mjygondgkwwyw3hwudkqd.onion

Targets

    • Target
      sample
    • Size 79KB
    • SHA256 25835a890a218fd26bfd8b23696576402b5eb8a4c9af4a51529e14c4f00a9cce
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks