General
-
Target
877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb
-
Size
1.1MB
-
Sample
220724-z4k2bagfe6
-
MD5
e3648731a36105980f5fae6b4afe614b
-
SHA1
85db743d14fbd83f893ec34dbdf57d0344e16156
-
SHA256
877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb
-
SHA512
dcf4742b7c059f4580d9bbee1c5e444eb37bc1ab4c183bb7697ac33cc8d74a2d2ad9016ba1dc6429deb31d7fc1cd101d3544806411682d49147b4fc08b0eea2f
Static task
static1
Behavioral task
behavioral1
Sample
877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8798098848a9e75a
https://mazedecrypt.top/8798098848a9e75a
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8712097de3d01abf
https://mazedecrypt.top/8712097de3d01abf
Targets
-
-
Target
877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb
-
Size
1.1MB
-
MD5
e3648731a36105980f5fae6b4afe614b
-
SHA1
85db743d14fbd83f893ec34dbdf57d0344e16156
-
SHA256
877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb
-
SHA512
dcf4742b7c059f4580d9bbee1c5e444eb37bc1ab4c183bb7697ac33cc8d74a2d2ad9016ba1dc6429deb31d7fc1cd101d3544806411682d49147b4fc08b0eea2f
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-