General
-
Target
WindowsRuntimeSecurity.bin.zip
-
Size
8KB
-
Sample
221009-w57d6ahdg4
-
MD5
2dbf428927fb3b2d587f457cf5664582
-
SHA1
fbad63c3e37fa265cc81f0b789ccb59016501604
-
SHA256
d66e28e2ae3a6287740d4f67c722f4e5f9db0cebec101380bdbf46ae76da6fe0
-
SHA512
1e74b2976239098e480d03b2f87a43ebee36f11743bece04dbfa2a27368dd898f7ba4d5a91ac7ffb9cc730ae6ac74dca5c86c39637889281ec83637a25a0adf4
-
SSDEEP
192:0d6Vt1X1kK9VgEgf/ug3KBRPUJh8Dy5Ad1sJmBPAktBLdP:0d67TgEtBRsgDaJahndP
Static task
static1
Behavioral task
behavioral1
Sample
WindowsRuntimeSecurity.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
WindowsRuntimeSecurity.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\ALL_OF_YOUR_FILES_ARE_ENCRYPTED_README.txt
https://tox.chat/download.html
Targets
-
-
Target
WindowsRuntimeSecurity.bin
-
Size
18KB
-
MD5
7799cb222f53fdea43585f7d40104ed6
-
SHA1
28d6fc08e1571db3c6358c4b3b6687517afb04ec
-
SHA256
38ccc368bf474e923dae79501b03b4c5cc62bf57890a99bd4b0a8b3867630e42
-
SHA512
101cdcbb66655065ca35985efd82862a626a3bf3d080f41713b5ca41f6861169a1f02a8e6d6b23dee65fb740d63af5e46f936b3bfd84537b8580d4b30060bc4f
-
SSDEEP
384:RixYSYy3Wd/xVAngX0GEmKPK7fUl49cHFMemGCI/mP4:mFYy3QxVRpqGe498MemrP4
Score10/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-