General
- Target [email protected]
- Size 330KB
- Sample241025-hzc2gawerf
- SHA256 acc791703bc6e6ec9dcad7ef28ea5bcd1cf70f0a17412b28078daa66df5989d8
- MD5 8c26c5bb599b606cc549ceef0d9d2da3
- SHA1 86a373936df7e753f7284efc63bf8970e9a56870
- SHA512 f05012ab52e2e88f0342d0a9fc52be210cdb4895035c4854592f350e24ddbcf48a710c25285c73a0462d51fe937540d491f5ce376e226558398cc1eb7bab2873
- SSDEEP 6144:ypBFADu1hgO8uoHKm9bDSN23GqcgCC/5t:sM6TgO1oHbHSN2334O
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Static task
static1
1 signatures
10 signatures
150 seconds
11 signatures
150 seconds
Malware Config
Targets
-
- Target [email protected]
- Size 330KB
- SHA256 acc791703bc6e6ec9dcad7ef28ea5bcd1cf70f0a17412b28078daa66df5989d8
- MD5 8c26c5bb599b606cc549ceef0d9d2da3
- SHA1 86a373936df7e753f7284efc63bf8970e9a56870
- SHA512 f05012ab52e2e88f0342d0a9fc52be210cdb4895035c4854592f350e24ddbcf48a710c25285c73a0462d51fe937540d491f5ce376e226558398cc1eb7bab2873
- SSDEEP 6144:ypBFADu1hgO8uoHKm9bDSN23GqcgCC/5t:sM6TgO1oHbHSN2334O
- MD5 SHA1 SHA512 SSDEEP
Score9/10-
Renames multiple (7752) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.