General
-
Target
7aac112635cbde748a97b38f6a52aaebbc3f0050f81cf36ccdc6c294c214fd73
-
Size
909KB
-
Sample
220520-tcr3naaad7
-
MD5
23296cd80227f6ca6d00221d42c1c7af
-
SHA1
72cfda2bb3914e5696c7f233daa515a2028ab2ef
-
SHA256
7aac112635cbde748a97b38f6a52aaebbc3f0050f81cf36ccdc6c294c214fd73
-
SHA512
68778a1c82b7ad2aeea4d4436ff37de5034bb234185c52c729561606f71b04548cdb1c08051580faf3838b815f0f832e6a1124d68c0d54fb4eec7d782275fc2f
Static task
static1
Behavioral task
behavioral1
Sample
7aac112635cbde748a97b38f6a52aaebbc3f0050f81cf36ccdc6c294c214fd73.ps1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
7aac112635cbde748a97b38f6a52aaebbc3f0050f81cf36ccdc6c294c214fd73.ps1
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\ProgramData\Microsoft\User Account Pictures\C49A25-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\odt\1CC86D-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
7aac112635cbde748a97b38f6a52aaebbc3f0050f81cf36ccdc6c294c214fd73
-
Size
909KB
-
MD5
23296cd80227f6ca6d00221d42c1c7af
-
SHA1
72cfda2bb3914e5696c7f233daa515a2028ab2ef
-
SHA256
7aac112635cbde748a97b38f6a52aaebbc3f0050f81cf36ccdc6c294c214fd73
-
SHA512
68778a1c82b7ad2aeea4d4436ff37de5034bb234185c52c729561606f71b04548cdb1c08051580faf3838b815f0f832e6a1124d68c0d54fb4eec7d782275fc2f
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-