General
-
Target
VirusShare_61b32a82577a7ea823ff7303ab6b4283
-
Size
898KB
-
Sample
230508-wdvw2sbh89
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
-
SSDEEP
12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\MSOCache\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6cd10cc68975313c
https://mazedecrypt.top/6cd10cc68975313c
Extracted
C:\odt\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c810cb8df074b89
https://mazedecrypt.top/6c810cb8df074b89
Targets
-
-
Target
VirusShare_61b32a82577a7ea823ff7303ab6b4283
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
-
SSDEEP
12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-