General
-
Target
dd1690bbc16c2b44da6f2291e14ab3635f90291a34109744a05e2c82489b3555
-
Size
1.5MB
-
Sample
220724-vtqrlacdam
-
MD5
22279fe757ad953e3eb1c22291ad2e18
-
SHA1
546e36a4323ad39f07916b05db196ea316c55d3f
-
SHA256
dd1690bbc16c2b44da6f2291e14ab3635f90291a34109744a05e2c82489b3555
-
SHA512
3e01ebacb78de2792910a08a5f1aa46b0c0e628d40069b8ea28c53894a59cacf3547305e5a1d8a03f6625b618027fbb53ed914bbafaa2f4b5984cfa12aadac6d
Behavioral task
behavioral1
Sample
dd1690bbc16c2b44da6f2291e14ab3635f90291a34109744a05e2c82489b3555.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
dd1690bbc16c2b44da6f2291e14ab3635f90291a34109744a05e2c82489b3555.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\README1.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Targets
-
-
Target
dd1690bbc16c2b44da6f2291e14ab3635f90291a34109744a05e2c82489b3555
-
Size
1.5MB
-
MD5
22279fe757ad953e3eb1c22291ad2e18
-
SHA1
546e36a4323ad39f07916b05db196ea316c55d3f
-
SHA256
dd1690bbc16c2b44da6f2291e14ab3635f90291a34109744a05e2c82489b3555
-
SHA512
3e01ebacb78de2792910a08a5f1aa46b0c0e628d40069b8ea28c53894a59cacf3547305e5a1d8a03f6625b618027fbb53ed914bbafaa2f4b5984cfa12aadac6d
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-