General
-
Target
3e5ca77f299d56fad7ebca8259eecd6f47efce6265e8ed621e7b7081f9230cdc
-
Size
270KB
-
Sample
240201-jcwezageam
-
MD5
ef2b61de2c6f393844e1de9ad7ffa3d4
-
SHA1
d3e04a5e5154d8cb5051dda8e73c75e241265082
-
SHA256
3e5ca77f299d56fad7ebca8259eecd6f47efce6265e8ed621e7b7081f9230cdc
-
SHA512
f5e5400874e19a1018e7ecb807f2eb56ef83d9cdfa2c977efe9094a362a830da00f753865616590461dc2a859359e839f04fa132ab601e38e8fe39927794ccd1
-
SSDEEP
6144:XqohGYel4VQg/U+Dgx3bMAVVzddi6jWGPxF:XqoglK53DgZMSVFjW0x
Static task
static1
Behavioral task
behavioral1
Sample
3e5ca77f299d56fad7ebca8259eecd6f47efce6265e8ed621e7b7081f9230cdc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3e5ca77f299d56fad7ebca8259eecd6f47efce6265e8ed621e7b7081f9230cdc.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
C:\Users\Admin\Contacts\Data breach warning.txt
https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye
Targets
-
-
Target
3e5ca77f299d56fad7ebca8259eecd6f47efce6265e8ed621e7b7081f9230cdc
-
Size
270KB
-
MD5
ef2b61de2c6f393844e1de9ad7ffa3d4
-
SHA1
d3e04a5e5154d8cb5051dda8e73c75e241265082
-
SHA256
3e5ca77f299d56fad7ebca8259eecd6f47efce6265e8ed621e7b7081f9230cdc
-
SHA512
f5e5400874e19a1018e7ecb807f2eb56ef83d9cdfa2c977efe9094a362a830da00f753865616590461dc2a859359e839f04fa132ab601e38e8fe39927794ccd1
-
SSDEEP
6144:XqohGYel4VQg/U+Dgx3bMAVVzddi6jWGPxF:XqoglK53DgZMSVFjW0x
Score10/10-
Renames multiple (212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-