netwalker | 22112bf777b7be134f4cc56336bfe34ce123748a4d34688de3c4e54504a638d8

General

Target
2025-04-02_a04a235b34e70b219cbca68cb7fc965f_babuk_mailto
Size 82KB
Sample250402-sx4frayzes
SHA256 22112bf777b7be134f4cc56336bfe34ce123748a4d34688de3c4e54504a638d8
MD5 a04a235b34e70b219cbca68cb7fc965f
SHA1 4bdcc0b24052b538d2c092c7c75989756412496d
SHA512 42e790410f6ffb244bd4f8fa7aa1e326860a2d1e010845f096561a9dda9dbc966b21a11df50e230207cd14b2346e027aa8a245e06d3602915594b1a9bc5ad0fc
SSDEEP 1536:SoF+QbXFzvL4ZwxY/ic0ty2XGf0s7pBZWNFMS2EgO1:SiFF7Loxt0tyAGf0sN5S2fO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Default\5BFE-Readme.txt

netwalker

Ransom Note

Hi! Your files are encrypted. All encrypted files for this computer has extension: .5bfe -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised, rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you, it could be files on the network belonging to other users, sure you want to take that responsibility? -- Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help. The only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover. We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned. For us this is just business and to prove to you our seriousness, we will decrypt you some files for free, but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision. Contact us: [email protected] [email protected] Don't forget to include your code in the email: {code_5bfe:kYqi/hDA2YHB6qHuQNOn7LcTsal9QCgQFD2k7EOGo/e01/0qFy PULQNUm89ZPtiOwAs4i0Yj6Spde000lHMzwC7fIE2bstFHOP1H BwawPdHVoP3O6720hocgi9Tc+tz0q94yfCpi0sm0cLXoo0Rx/B +cyJqbEackXfTz+zubxC2XLKtXVMiFoKMhkMjzdsVpKWU/lTkH j+LqjsLMFx3McRJRDBUt+9iy6gEE7jVYoR7AKVvAyn0wSVdlOa JP7lS+++129NCnPTbBcBcDr8Faf7S/DQ==}

Emails

Targets

- Target
  2025-04-02_a04a235b34e70b219cbca68cb7fc965f_babuk_mailto
- Size 82KB
- SHA256 22112bf777b7be134f4cc56336bfe34ce123748a4d34688de3c4e54504a638d8
- MD5 a04a235b34e70b219cbca68cb7fc965f
- SHA1 4bdcc0b24052b538d2c092c7c75989756412496d
- SHA512 42e790410f6ffb244bd4f8fa7aa1e326860a2d1e010845f096561a9dda9dbc966b21a11df50e230207cd14b2346e027aa8a245e06d3602915594b1a9bc5ad0fc
- SSDEEP 1536:SoF+QbXFzvL4ZwxY/ic0ty2XGf0s7pBZWNFMS2EgO1:SiFF7Loxt0tyAGf0sN5S2fO
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

netwalker defense_evasion discovery execution impact persistence ransomware
- Detected Netwalker Ransomware
  Detected unpacked Netwalker executable.
- Netwalker Ransomware
  Ransomware family with multiple versions. Also known as MailTo.
  ransomware netwalker
- Netwalker family
  netwalker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (156) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1