General

  • Target

    1fb613ee3b0e7f96f5dea029aae31b86340b0724e88f84a76b386af84d1cf95c

  • Size

    27KB

  • Sample

    200708-95zdmv32xs

  • MD5

    4ae2e5156253fbeed2c6f13a066c98a1

  • SHA1

    db318de72c2cdda1822999441d23b91e933a772b

  • SHA256

    1fb613ee3b0e7f96f5dea029aae31b86340b0724e88f84a76b386af84d1cf95c

  • SHA512

    c00c1c47e4cffaa3078885bbca42e6663bb478ec33b5b742c752412b204af55bf94008868264d0b03279339017732330e64c52d3b20f55e347194f65f2147be2

Malware Config

Extracted

Path

C:\How_To_Restore_Your_Files.txt

Ransom Note
[+] All Your Files Have Been Encrypted [+] [-] Do You Really Want To Restore Your Files? [-] Write Us To The E-Mail : [email protected] [-] Write Your Unique-ID In The Title Of Your Message. [+] Unique-ID : F86B013E [-] You Have To Pay For Decryption In Bitcoins. [-] The Price Depends On How Fast You Write To Us. [-] After Payment We Will Send You The Decryption Tool That Will Decrypt All Your Files. _______________________________________________________ [+] Free Decryption As Guarantee [+] [-] Before Paying You Can Send Us Up To 5 Files For Free Decryption, The Total Size Of Files Must Bee Less Than 10MB, (Non Archived) And Files Should Not Contain Valuable Information (Databases, Backups, Large Excel -Sheets, Etc). _______________________________________________________ [+] How To Obtain Bitcoins [+] [-] The Easiest Way To Buy Bitcoins Is LocalBitcoins Site : https://localbitcoins.com/buy_bitcoins You Have To Register, Click 'Buy Bitcoins', And Select The Seller By Payment Method And Price. [-] Also You Can Find Other Places To Buy Bitcoins And Beginners Guide Here: http://coindesk.com/information/how-can-i-buy-bitcoins _______________________________________________________ [+] Attention! [+] [-] Do Not Rename Encrypted Files. [-] Do Not Try To Decrypt Your Data Using Third Party -Software, It May Cause Permanent Data Loss. [-] Decryption Of Your Files With The Help Of Third Parties May Cause Increased Price (They Add Their Fee To Our) Or You Can Become A Victim Of A Scam. _____________________CoronaCrypt_______________________
URLs

http://coindesk.com/information/how-can-i-buy-bitcoins

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail Write this ID in the title of your message You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee How to obtain Bitcoins Also you can find other places to buy Bitcoins and beginners guide here: Attention!

Extracted

Path

C:\How_To_Restore_Your_Files.txt

Ransom Note
[+] All Your Files Have Been Encrypted [+] [-] Do You Really Want To Restore Your Files? [-] Write Us To The E-Mail : [email protected] [-] Write Your Unique-ID In The Title Of Your Message. [+] Unique-ID : 949CEBC7 [-] You Have To Pay For Decryption In Bitcoins. [-] The Price Depends On How Fast You Write To Us. [-] After Payment We Will Send You The Decryption Tool That Will Decrypt All Your Files. _______________________________________________________ [+] Free Decryption As Guarantee [+] [-] Before Paying You Can Send Us Up To 5 Files For Free Decryption, The Total Size Of Files Must Bee Less Than 10MB, (Non Archived) And Files Should Not Contain Valuable Information (Databases, Backups, Large Excel -Sheets, Etc). _______________________________________________________ [+] How To Obtain Bitcoins [+] [-] The Easiest Way To Buy Bitcoins Is LocalBitcoins Site : https://localbitcoins.com/buy_bitcoins You Have To Register, Click 'Buy Bitcoins', And Select The Seller By Payment Method And Price. [-] Also You Can Find Other Places To Buy Bitcoins And Beginners Guide Here: http://coindesk.com/information/how-can-i-buy-bitcoins _______________________________________________________ [+] Attention! [+] [-] Do Not Rename Encrypted Files. [-] Do Not Try To Decrypt Your Data Using Third Party -Software, It May Cause Permanent Data Loss. [-] Decryption Of Your Files With The Help Of Third Parties May Cause Increased Price (They Add Their Fee To Our) Or You Can Become A Victim Of A Scam. _____________________CoronaCrypt_______________________
URLs

http://coindesk.com/information/how-can-i-buy-bitcoins

Targets

    • Target

      1fb613ee3b0e7f96f5dea029aae31b86340b0724e88f84a76b386af84d1cf95c

    • Size

      27KB

    • MD5

      4ae2e5156253fbeed2c6f13a066c98a1

    • SHA1

      db318de72c2cdda1822999441d23b91e933a772b

    • SHA256

      1fb613ee3b0e7f96f5dea029aae31b86340b0724e88f84a76b386af84d1cf95c

    • SHA512

      c00c1c47e4cffaa3078885bbca42e6663bb478ec33b5b742c752412b204af55bf94008868264d0b03279339017732330e64c52d3b20f55e347194f65f2147be2

    • Deletes itself

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run entry to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks