General
- Target DirectX_Update.bin.zip
- Size 199KB
- Sample200823-88h7nmjfv2
- SHA256 5dd45efe2b08a6566739cb61978ea7f0ce3badc64220475c6e62eadb16938278
Score
10/10
Malware Config
Extracted
Path
-
C:\ATTENTION-feeef-README.txt
Ransom Note
- Sorry, but your files are locked due to a critical error in your system. If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay BITCOINS to get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://restore-now.top/online-chat/ If your site does not open, then download the TOR browser (https://torproject.org/). If you can�t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://i6jppiczqa5moqfl57gssi33npwfseqppdsnz7rriiv7suf4pf4w42id.onion After going to the site, enter the information: Your ID: 67622281495 Personal key: bWxsbG0oSGt0cHUoPT49OTk5Pzg7QDwoSkEnOTw8Njk6PidOaUM2aXlFJw== Your Email
URLs
-
http://restore-now.top/online-chat/
-
http://i6jppiczqa5moqfl57gssi33npwfseqppdsnz7rriiv7suf4pf4w42id.onion
Extracted
Path
-
C:\ATTENTION-acbbf-README.txt
Ransom Note
- Sorry, but your files are locked due to a critical error in your system. If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay BITCOINS to get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://restore-now.top/online-chat/ If your site does not open, then download the TOR browser (https://torproject.org/). If you can�t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://i6jppiczqa5moqfl57gssi33npwfseqppdsnz7rriiv7suf4pf4w42id.onion After going to the site, enter the information: Your ID: 09302895631 Personal key: aGppaW0oSGt0cHUoN0A6Nzk/QDw9OjgoSkEnOTw8Njk6PydOaUM2aXlFJw== Your Email
URLs
-
http://restore-now.top/online-chat/
-
http://i6jppiczqa5moqfl57gssi33npwfseqppdsnz7rriiv7suf4pf4w42id.onion
Targets
-
- Target DirectX_Update.bin
- Size 401KB
- SHA256 30718dcdb6fc8e48a442f5b1f63e413e69f6cf2a279fed1c7c80e9517a133317
Score10/10Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
Adds Run key to start application
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Modifies service