General
- Target e50d52fbac295a37f0ed0b724d4ddafca8c86bcd2391b4c481d51d5e279afd20
- Size 4.6MB
- Sample200713-a751hw8tr6
- SHA256 e50d52fbac295a37f0ed0b724d4ddafca8c86bcd2391b4c481d51d5e279afd20
Score
10/10
Malware Config
Extracted
Path
-
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT
Ransom Note
- Hello! All your files are encrypted and only I can decrypt them. Contact me: [email protected] or [email protected] Write me if you want to return your files - I can do it very quickly! The header of letter must contain extension of encrypted files. I'm always reply within 24 hours. If not - check spam folder, resend your letter or try send letter from another email service (like protonmail.com). Attention! Do not rename or edit encrypted files: you may have permanent data loss. To prove that I can recover your files, I am ready to decrypt any three files (less than 1Mb) for free (except databases, Excel and backups) HURRY UP!
Targets
-
- Target e50d52fbac295a37f0ed0b724d4ddafca8c86bcd2391b4c481d51d5e279afd20
- Size 4.6MB
- SHA256 e50d52fbac295a37f0ed0b724d4ddafca8c86bcd2391b4c481d51d5e279afd20
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service