General
-
Target
4968b25781df2d8913de37ac6a0dab897ce97bbe49d7f644b29284fecff711f6.na
-
Size
442KB
-
Sample
240112-n12zwagba8
-
MD5
81b760d4057c7c704f18c3f6b3e6b2c4
-
SHA1
94c93a3b17485e75be82635229ddcfd2445747e6
-
SHA256
4968b25781df2d8913de37ac6a0dab897ce97bbe49d7f644b29284fecff711f6
-
SHA512
b6a0d309e4ba2e9ac063fdf137e9773281dc90ca5b182f28a6807571358332d25bc070566681198ab62592b36eaa71dbf8cc8c8898b0071d0cff6d680edb6c33
-
SSDEEP
12288:TSk6ijDCWl0Qc4a6eCSgn/p2TzZfDt4yfoBuuRe:Ok6iPRME9n/peZfp4yfoUuRe
Behavioral task
behavioral1
Sample
4968b25781df2d8913de37ac6a0dab897ce97bbe49d7f644b29284fecff711f6.na
Resource
ubuntu1804-amd64-20231221-en
Malware Config
Extracted
/read-me3.txt
http://j3qxmk6g5sk3zw62i2yhjnwmhm55rfz47fdyfkhaithlpelfjdokdxad.onion/22028d19e1b8eab7cf6cbc66c065f0ace41671f8c2a40fde323e3a2e95ccff05603c628d5967841259e9e09927dbdd54597dc1ae870e8b380d97a78239eb134a1f3cf6374b8b7ff894d166eaf0c4926986cb38cff9727a9a34a2fc89b9f38baeeff27df12b3fca403687f97f174af2498a6ba1de15eb77c69d605f7b65de123dc6f0/
Targets
-
-
Target
4968b25781df2d8913de37ac6a0dab897ce97bbe49d7f644b29284fecff711f6.na
-
Size
442KB
-
MD5
81b760d4057c7c704f18c3f6b3e6b2c4
-
SHA1
94c93a3b17485e75be82635229ddcfd2445747e6
-
SHA256
4968b25781df2d8913de37ac6a0dab897ce97bbe49d7f644b29284fecff711f6
-
SHA512
b6a0d309e4ba2e9ac063fdf137e9773281dc90ca5b182f28a6807571358332d25bc070566681198ab62592b36eaa71dbf8cc8c8898b0071d0cff6d680edb6c33
-
SSDEEP
12288:TSk6ijDCWl0Qc4a6eCSgn/p2TzZfDt4yfoBuuRe:Ok6iPRME9n/peZfp4yfoUuRe
Score10/10-
Renames multiple (2461) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies Bash startup script
-