General
-
Target
ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2
-
Size
79KB
-
Sample
221009-pw37taghh4
-
MD5
fa758e45dae3e8a7506f6b7663ccb4b4
-
SHA1
ecdcc9bc595e93dfedbe26352d7a954a69d4a8ea
-
SHA256
ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2
-
SHA512
01598cfbde622afbc52ba17d406b459f4cb4c8db6a15eaa3f906eba9ea3ba920e61632383e35117c7c4fb1757c3aab9a291507228570b5cfdcac94de684cbe3c
-
SSDEEP
1536:4pykWBeG/vEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:ZBeQsmsrQLOJgY8Zp8LHD4XWaNH71dLc
Static task
static1
Behavioral task
behavioral1
Sample
ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\How To Restore Your Files.txt
https://t.me/bbkte4m
Targets
-
-
Target
ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2
-
Size
79KB
-
MD5
fa758e45dae3e8a7506f6b7663ccb4b4
-
SHA1
ecdcc9bc595e93dfedbe26352d7a954a69d4a8ea
-
SHA256
ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2
-
SHA512
01598cfbde622afbc52ba17d406b459f4cb4c8db6a15eaa3f906eba9ea3ba920e61632383e35117c7c4fb1757c3aab9a291507228570b5cfdcac94de684cbe3c
-
SSDEEP
1536:4pykWBeG/vEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:ZBeQsmsrQLOJgY8Zp8LHD4XWaNH71dLc
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-