General
- Target 32Bit.bin.zip
- Size 9.4MB
- Sample200913-jegg8khgp2
- SHA256 bf536ce5dda81ac7309daddf5116d8fe374656f04e65ca9d02751d0fc88c1228
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\!! YOUR FILES HAS BEEN ENCRYPTED !!.txt
-
crypt32
Ransom Note
- Your files has been encrypted by ransomware! and You can't decrypt with money. Please install heroes of the storm to decrypt your files. Attention: DO NOT TURN OFF YOUR PC! IF YOU TURNED OFF YOUR PC, YOU WON'T ABLE TO DECRYPT YOUR FILES! Emergency contact: [email protected] Warning - Any attmpt of decryption file will delete your private key. 당신의 파일들은 랜섬웨어에 의해 암호화되었습니다. 그리고 돈을 줘도 풀 수 없습니다. 히어로즈 오브 더 스톰을 설치해서 파일들을 복호화하세요. 경고: PC를 끄지 마세요! PC를 끄면 파일을 복원할 수 없습니다! 긴급 연락 이메일: [email protected] 경고: 복호화를 시도하면 파일들은 절대 다시 풀 수 없습니다.
Emails
Targets
-
- Target 32Bit.bin
- Size 9.7MB
- SHA256 9f52465538d7c804116e77fab868a87c85d318ffc8970fe7e8a2c846d97a1f74
Score10/10-
Crypt32 Ransomware
Javascript Fan-extortionist malware which demands victims install Heroes of the Storm instead of a monetary ransom. Uses Crypto-JS library for encryption.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
JavaScript code in executable