General
-
Target
861340ff0057af288032d94212eb0252ca6b37c53653e28a607620e597221711
-
Size
909KB
-
Sample
220520-qwpj4aebg6
-
MD5
0abc6981dc66033e0fae0351025d6399
-
SHA1
ebe3b9509911f6af5438df3162a0cd756253bbaf
-
SHA256
861340ff0057af288032d94212eb0252ca6b37c53653e28a607620e597221711
-
SHA512
3cd6aa783390d6f619394169884fe739230e7de4a25195715d1770614374fd6038f23d0bffc5f0508730eee2ab1c37bac67022b0d7cb6f43bd7e98989a9a0c39
Static task
static1
Behavioral task
behavioral1
Sample
861340ff0057af288032d94212eb0252ca6b37c53653e28a607620e597221711.ps1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
861340ff0057af288032d94212eb0252ca6b37c53653e28a607620e597221711.ps1
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\650913-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\odt\962775-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
861340ff0057af288032d94212eb0252ca6b37c53653e28a607620e597221711
-
Size
909KB
-
MD5
0abc6981dc66033e0fae0351025d6399
-
SHA1
ebe3b9509911f6af5438df3162a0cd756253bbaf
-
SHA256
861340ff0057af288032d94212eb0252ca6b37c53653e28a607620e597221711
-
SHA512
3cd6aa783390d6f619394169884fe739230e7de4a25195715d1770614374fd6038f23d0bffc5f0508730eee2ab1c37bac67022b0d7cb6f43bd7e98989a9a0c39
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-