General
-
Target
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304.zip
-
Size
139KB
-
Sample
221216-b6t51agf9x
-
MD5
ec13b77565cad2820f8f7489794c9d61
-
SHA1
4c11e7557980be2d481917d11746178c4f237784
-
SHA256
aac978c3de17df019ea0f1df536206f73b9a46398fbb7f2a3a7d759e359c5461
-
SHA512
40cd78354664cbac3e3443f89222ec5d5d9dafc974e523e4d837943d6b3a9c2d2b298eb7404c659742aa469973cfd3a47935f27c72215ca20a90863b33f5ce26
-
SSDEEP
3072:21VnBYDqqv00bE1z7u6fCaVPndu+u1yjJ771RG3zoS:2PCGYgB7zb/FYQJS
Static task
static1
Behavioral task
behavioral1
Sample
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304.ps1
Resource
win10v2004-20221111-en
Malware Config
Extracted
C:\251DD8-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304.ps1
-
Size
902KB
-
MD5
7770c598848339cf3562b7480856d584
-
SHA1
b3d39042aab832b7d2bed732c8b8e600a4cf5197
-
SHA256
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304
-
SHA512
02af6d5910f0627074fbea72901b2f2b491f7dba58f53ae1fad1dc47230e000a7b459c8475a76aaf006629bb5822d89d4672d32fb64d073464ca41140cb134d2
-
SSDEEP
6144:KxYcCQ2x63Ib0NQrqxpPbI1ZVedvUhwDNGjG+zBumDKemdglhykA:KCQ2x6TdvUqDUjG+zBumDKemdgy9
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-