General
-
Target
2025-03-19_f269b093efda6d6e17722e22ab039dc0_mailto
-
Size
65KB
-
Sample
250319-jma7saxqw8
-
MD5
f269b093efda6d6e17722e22ab039dc0
-
SHA1
9a286a1b46cde97a52bd08c38c0c3dbe0d1c618a
-
SHA256
134998ecb0f44bf191d9202fa7ed77b15b0ae4572300faed7b0be97f37699036
-
SHA512
79d4a03bbb08a35450fcc46a89cbfd331ac0e0409fbbee12634ecb99c4e323ba7ebc7cce3a0ff4a9b4e45e272886ea455d4b02832eafff3654daf4891e6d6c78
-
SSDEEP
1536:kxZab6DtoaWM7pgUJJooLrIZadXRM0CFU6PuZhw:3GDtDD7prbooLrWaPM0RZG
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-19_f269b093efda6d6e17722e22ab039dc0_mailto.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-03-19_f269b093efda6d6e17722e22ab039dc0_mailto.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\25810B-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Public\Libraries\9657F4-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
2025-03-19_f269b093efda6d6e17722e22ab039dc0_mailto
-
Size
65KB
-
MD5
f269b093efda6d6e17722e22ab039dc0
-
SHA1
9a286a1b46cde97a52bd08c38c0c3dbe0d1c618a
-
SHA256
134998ecb0f44bf191d9202fa7ed77b15b0ae4572300faed7b0be97f37699036
-
SHA512
79d4a03bbb08a35450fcc46a89cbfd331ac0e0409fbbee12634ecb99c4e323ba7ebc7cce3a0ff4a9b4e45e272886ea455d4b02832eafff3654daf4891e6d6c78
-
SSDEEP
1536:kxZab6DtoaWM7pgUJJooLrIZadXRM0CFU6PuZhw:3GDtDD7prbooLrWaPM0RZG
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Netwalker family
-
Renames multiple (7453) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself
-