General
-
Target
702099b63cb2384e11f088d6bc33afbd43a4c91848f393581242a6a17f1b30a0.bin
-
Size
211KB
-
Sample
220913-efb4aaadcm
-
MD5
b774d0ad0ae7a9d3ec00281bc8682cd2
-
SHA1
6c8d2b7035721dd184597cfd2864b0afd28d7bd2
-
SHA256
702099b63cb2384e11f088d6bc33afbd43a4c91848f393581242a6a17f1b30a0
-
SHA512
606dcbfea802773509d30e7de88209a5abe11f89697bdf8dbe92a89252ed4cc9873a64797d19e2cbd71b1a39a6ed06d76a0d59821592d44a6f8a6c9e45bd94eb
-
SSDEEP
3072:owAJkyMS4a+RQ3dTmx0Tth+cySxE+s9WRhP6v8xZduobdwV:RAJeRQ3dT++GnOR/5bGV
Static task
static1
Behavioral task
behavioral1
Sample
702099b63cb2384e11f088d6bc33afbd43a4c91848f393581242a6a17f1b30a0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
702099b63cb2384e11f088d6bc33afbd43a4c91848f393581242a6a17f1b30a0.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\readme.txt
http://4s4lnfeujzo67fy2jebz2dxskez2gsqj2jeb35m75ktufxensdicqxad.onion/chat/3194223a728c446ebfb50c494adb674da4d8c5622e124bcca9943f2b9a3f35f7/
Targets
-
-
Target
702099b63cb2384e11f088d6bc33afbd43a4c91848f393581242a6a17f1b30a0.bin
-
Size
211KB
-
MD5
b774d0ad0ae7a9d3ec00281bc8682cd2
-
SHA1
6c8d2b7035721dd184597cfd2864b0afd28d7bd2
-
SHA256
702099b63cb2384e11f088d6bc33afbd43a4c91848f393581242a6a17f1b30a0
-
SHA512
606dcbfea802773509d30e7de88209a5abe11f89697bdf8dbe92a89252ed4cc9873a64797d19e2cbd71b1a39a6ed06d76a0d59821592d44a6f8a6c9e45bd94eb
-
SSDEEP
3072:owAJkyMS4a+RQ3dTmx0Tth+cySxE+s9WRhP6v8xZduobdwV:RAJeRQ3dT++GnOR/5bGV
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops desktop.ini file(s)
-