General
-
Target
6713403015feb8959093f5d007bcbdbb3be9eec96dd62f517786b67506067251.dll
-
Size
733KB
-
Sample
221002-xcswqsfdh7
-
MD5
460cb38e14fcadef06e267047ce9d69e
-
SHA1
b5f99fc2edba2891b6d947aacd3c32be5b43ba4c
-
SHA256
6713403015feb8959093f5d007bcbdbb3be9eec96dd62f517786b67506067251
-
SHA512
312cdb07d8b4c278d0afd8de73bfa276cffa2980005ca519cff1f7c06ce8ad4811f4ae791b861d1caa6e2891615eb963800977f2efb739a04b7c54107de1d7f1
-
SSDEEP
12288:k5/glZ0FL3v6n2KwlrIf8U1UaqPDcGr+UJZj4vKHdyicKK6:OglOF763Kq8U1U3eixExM
Static task
static1
Behavioral task
behavioral1
Sample
6713403015feb8959093f5d007bcbdbb3be9eec96dd62f517786b67506067251.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6713403015feb8959093f5d007bcbdbb3be9eec96dd62f517786b67506067251.dll
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c550cb4cb94778c
https://mazedecrypt.top/6c550cb4cb94778c
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b370c9f9ae8a9b6
https://mazedecrypt.top/6b370c9f9ae8a9b6
Targets
-
-
Target
6713403015feb8959093f5d007bcbdbb3be9eec96dd62f517786b67506067251.dll
-
Size
733KB
-
MD5
460cb38e14fcadef06e267047ce9d69e
-
SHA1
b5f99fc2edba2891b6d947aacd3c32be5b43ba4c
-
SHA256
6713403015feb8959093f5d007bcbdbb3be9eec96dd62f517786b67506067251
-
SHA512
312cdb07d8b4c278d0afd8de73bfa276cffa2980005ca519cff1f7c06ce8ad4811f4ae791b861d1caa6e2891615eb963800977f2efb739a04b7c54107de1d7f1
-
SSDEEP
12288:k5/glZ0FL3v6n2KwlrIf8U1UaqPDcGr+UJZj4vKHdyicKK6:OglOF763Kq8U1U3eixExM
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-