Overview
overview
7Static
static
3Monocypher...er.zip
windows7-x64
1Monocypher...er.zip
windows10-2004-x64
1LICENSE.txt
windows7-x64
1LICENSE.txt
windows10-2004-x64
1Monocypher...er.exe
windows7-x64
7Monocypher...er.exe
windows10-2004-x64
7Monocypher...er.pyc
windows7-x64
3Monocypher...er.pyc
windows10-2004-x64
3api-ms-win...-0.dll
windows7-x64
1api-ms-win...-0.dll
windows10-2004-x64
1help.txt
windows7-x64
1help.txt
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21-08-2023 16:18
Behavioral task
behavioral1
Sample
Monocypher_AEAD_explorer.zip
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Monocypher_AEAD_explorer.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
LICENSE.txt
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
LICENSE.txt
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Monocypher_AEAD_explorer.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Monocypher_AEAD_explorer.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Monocypher_AEAD_explorer.pyc
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
Monocypher_AEAD_explorer.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
api-ms-win-core-path-l1-1-0.dll
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
api-ms-win-core-path-l1-1-0.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
help.txt
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
help.txt
Resource
win10v2004-20230703-en
General
-
Target
help.txt
-
Size
3KB
-
MD5
0df78e9e2f9090507ccf95da137de0ca
-
SHA1
aa9fae74acec5862507d6591ca5e536a8189f4ba
-
SHA256
fde1fd8fa0fe7f2340dbe4495e38721a9307a55bc2d3f1f7e3a96613739e07d2
-
SHA512
d5e4c366b2f8b1b61567d24ae2fb662b7b2d476fc4dbbc61fc3f15d9e01062d93bb63f73200caac1e454d7c293ecf69205924d9edbfe88abc47c763fc143d8c8
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2252 NOTEPAD.EXE