General
-
Target
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af.exe
-
Size
478KB
-
Sample
231012-p6yp3sch62
-
MD5
deebbea18401e8b5e83c410c6d3a8b4e
-
SHA1
96d81e77b6af8f54a5ac07b2c613a5655dd05353
-
SHA256
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af
-
SHA512
a0396c82fb68cf3931f0a2fcdba580d51ec6069c82b4e3853341fc6971a4bde4dbeb0094b94379d1dce4b1d8c43703e86266156ecbee89f9c939a71cafe9d487
-
SSDEEP
12288:2GOrdqXg+Hy7WxHXkzYHD9Fg0CNDG+X9MOguRTzxH/F:EjuSWxHY0C5PXmOgEhN
Static task
static1
Behavioral task
behavioral1
Sample
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
C:\Users\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/88a0099fc32db38
https://mazedecrypt.top/88a0099fc32db38
Extracted
C:\$Recycle.Bin\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/88d4099aeafb07c5
https://mazedecrypt.top/88d4099aeafb07c5
Targets
-
-
Target
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af.exe
-
Size
478KB
-
MD5
deebbea18401e8b5e83c410c6d3a8b4e
-
SHA1
96d81e77b6af8f54a5ac07b2c613a5655dd05353
-
SHA256
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af
-
SHA512
a0396c82fb68cf3931f0a2fcdba580d51ec6069c82b4e3853341fc6971a4bde4dbeb0094b94379d1dce4b1d8c43703e86266156ecbee89f9c939a71cafe9d487
-
SSDEEP
12288:2GOrdqXg+Hy7WxHXkzYHD9Fg0CNDG+X9MOguRTzxH/F:EjuSWxHY0C5PXmOgEhN
Score10/10-
Windows Defender anti-emulation file check
Defender's emulator always creates certain fake files which can be used to detect it.
-
Drops startup file
-