General
-
Target
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304.ps1
-
Size
902KB
-
Sample
250328-q6e4eawzbv
-
MD5
7770c598848339cf3562b7480856d584
-
SHA1
b3d39042aab832b7d2bed732c8b8e600a4cf5197
-
SHA256
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304
-
SHA512
02af6d5910f0627074fbea72901b2f2b491f7dba58f53ae1fad1dc47230e000a7b459c8475a76aaf006629bb5822d89d4672d32fb64d073464ca41140cb134d2
-
SSDEEP
6144:KxYcCQ2x63Ib0NQrqxpPbI1ZVedvUhwDNGjG+zBumDKemdglhykA:KCQ2x6TdvUqDUjG+zBumDKemdgy9
Static task
static1
Behavioral task
behavioral1
Sample
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304.ps1
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\BEDB44-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\IdentityCRL\production\772ABF-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304.ps1
-
Size
902KB
-
MD5
7770c598848339cf3562b7480856d584
-
SHA1
b3d39042aab832b7d2bed732c8b8e600a4cf5197
-
SHA256
ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304
-
SHA512
02af6d5910f0627074fbea72901b2f2b491f7dba58f53ae1fad1dc47230e000a7b459c8475a76aaf006629bb5822d89d4672d32fb64d073464ca41140cb134d2
-
SSDEEP
6144:KxYcCQ2x63Ib0NQrqxpPbI1ZVedvUhwDNGjG+zBumDKemdglhykA:KCQ2x6TdvUqDUjG+zBumDKemdgy9
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Netwalker family
-
Renames multiple (540) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-