General
-
Target
f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be
-
Size
5.1MB
-
Sample
240923-wewvqsyfmf
-
MD5
b1f0093b89561c6123070165bd2261e2
-
SHA1
aac57162dc1311f07a869f7163bd30e0d62dcc0e
-
SHA256
f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be
-
SHA512
637b40a33fc8e5d478128242f621ceefcb158b1d411898fbf4bb2e7352fd214befd58c308297108d631d5b4e4b44f953ac51676b02ef20e8de9dc122ef0ba797
-
SSDEEP
24576:3lWHR7hoxn6yTYo1oc8UcMIh/MuwL+zn4ltC3O+wXCwNLaLRcfIAM1Bq9p0IQWwS:l
Static task
static1
Behavioral task
behavioral1
Sample
f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be.ps1
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\A0CD44-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Crashpad\034FBF-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be
-
Size
5.1MB
-
MD5
b1f0093b89561c6123070165bd2261e2
-
SHA1
aac57162dc1311f07a869f7163bd30e0d62dcc0e
-
SHA256
f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be
-
SHA512
637b40a33fc8e5d478128242f621ceefcb158b1d411898fbf4bb2e7352fd214befd58c308297108d631d5b4e4b44f953ac51676b02ef20e8de9dc122ef0ba797
-
SSDEEP
24576:3lWHR7hoxn6yTYo1oc8UcMIh/MuwL+zn4ltC3O+wXCwNLaLRcfIAM1Bq9p0IQWwS:l
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7389) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-