82375e3a9ac1890fa3fb693673e107e4fab53778a2d4cb9b00c4f045dd995697

General

Target

DCryptSoft.bin.zip
Size

54KB
Sample

200814-7d3vjpa6zn
MD5

ea9f108ec67164c013d7aca86c70abff
SHA1

9af6be92b0f72c1d375a00162f6d19612dd75351
SHA256

82375e3a9ac1890fa3fb693673e107e4fab53778a2d4cb9b00c4f045dd995697
SHA512

e115399e094745104d0560f9f4d56c22130288be4b981d79670f38325f9f8b9f8da0aa748722f9f38f5eea23afe96708423feda163a4e88074c6d962227a8053

Score

10^/10

Malware Config

Extracted

Path

\??\M:\Boot\cs-CZ\Read_Me.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://54fjmcwsszltlixn.onion/?QQQQQQQQ 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/

URLs

http://54fjmcwsszltlixn.onion/?QQQQQQQQ

http://helpqvrg3cc5mvb3.onion/

Extracted

Path

\??\M:\Read_Me.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://54fjmcwsszltlixn.onion/?UWXZACEF 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/

URLs

http://54fjmcwsszltlixn.onion/?UWXZACEF

http://helpqvrg3cc5mvb3.onion/

Targets

- Target
  
  DCryptSoft.bin
- Size
  
  106KB
- MD5
  
  8ba537f8d00a73d6cc1cc5dffa566ed1
- SHA1
  
  08419f52af8acc1bdac239bd65f64414597a8d96
- SHA256
  
  aac2024789ffd2bfce97d6a509136ecf7c43b18c2a83280b596e62d988cedb10
- SHA512
  
  7bc28f475d504e945d690ad998987d4184269dac8f7470842f356a50f9ff59dd1595b6cf87b2015844d7c3cf84e39f989a648700d28561251dc59428177a14f7
Score

10^/10

ransomware persistence spyware
- Registers COM server for autorun
  persistence
- Modifies Installed Components in the registry
  persistence
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Drops desktop.ini file(s)
- Enumerates connected drives
- JavaScript code in executable
- Modifies service
  persistence
behavioral1 behavioral2