General
-
Target
afbe838c881e5b223351ff8fa05ddeb3678581ba
-
Size
469KB
-
Sample
230201-fwt5gadh2z
-
MD5
ca927fc487ca5f9196493b8f22ff611c
-
SHA1
afbe838c881e5b223351ff8fa05ddeb3678581ba
-
SHA256
f51e0302d11df00fa3f348551e77fa440f3ce517865e6e66457a011e9b17aba7
-
SHA512
ea378b42b359cc6f96d583edfb36c481400eb84309a999e8cc0a02516bd6f7747c33406243cce58045646aaf486fe10d00c967730a517e00e4f6aff17bee13bf
-
SSDEEP
12288:+OvAIoUP9j/gCiGjc7IekhA2LRRSPgjbn+jMvrCE:1IhUV/5R2I7hHLR9L+jMeE
Static task
static1
Behavioral task
behavioral1
Sample
afbe838c881e5b223351ff8fa05ddeb3678581ba.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
afbe838c881e5b223351ff8fa05ddeb3678581ba.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/870009826050357e
https://mazedecrypt.top/870009826050357e
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/870e09739e108f13
https://mazedecrypt.top/870e09739e108f13
Targets
-
-
Target
afbe838c881e5b223351ff8fa05ddeb3678581ba
-
Size
469KB
-
MD5
ca927fc487ca5f9196493b8f22ff611c
-
SHA1
afbe838c881e5b223351ff8fa05ddeb3678581ba
-
SHA256
f51e0302d11df00fa3f348551e77fa440f3ce517865e6e66457a011e9b17aba7
-
SHA512
ea378b42b359cc6f96d583edfb36c481400eb84309a999e8cc0a02516bd6f7747c33406243cce58045646aaf486fe10d00c967730a517e00e4f6aff17bee13bf
-
SSDEEP
12288:+OvAIoUP9j/gCiGjc7IekhA2LRRSPgjbn+jMvrCE:1IhUV/5R2I7hHLR9L+jMeE
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Loads dropped DLL
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-