General
- Target pewpew_p.bin.zip
- Size 1.0MB
- Sample200922-vpaskbkcsa
- SHA256 b24138773df4528b653442a1640a3f480a3172015c6fe1997979d5a52a85e8dd
Score
10/10
Malware Config
Extracted
Path
-
C:\info-decrypt.txt
Ransom Note
- All your files have been encrypted ! ( All your files have been encrypted with AES256 + RSA2048 Algorithm due to a security problem with your PC ) - If you want to restore them, write us to the e-mail : [email protected] - Write this ID in the title of your message : F86B013E - If you do not receive a response within 12 hours, send a message to this email : [email protected] ( You have to pay for decryption in Bitcoins ) - The price depends on how fast you write to us. - After payment we will send you the decryption tool that will decrypt all your files. ( Free decryption as guarantee ) - Before paying you can send us up to 1 file for free decryption. - The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) ( How to obtain Bitcoins ) - The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. - https://localbitcoins.com/buy_bitcoins - Also you can find other places to buy Bitcoins and beginners guide here: - http://www.coindesk.com/information/how-can-i-buy-bitcoins/ - [ pewpew TEAM ]
Extracted
Path
-
C:\info-decrypt.txt
Ransom Note
- All your files have been encrypted ! ( All your files have been encrypted with AES256 + RSA2048 Algorithm due to a security problem with your PC ) - If you want to restore them, write us to the e-mail : [email protected] - Write this ID in the title of your message : F822B9BB - If you do not receive a response within 12 hours, send a message to this email : [email protected] ( You have to pay for decryption in Bitcoins ) - The price depends on how fast you write to us. - After payment we will send you the decryption tool that will decrypt all your files. ( Free decryption as guarantee ) - Before paying you can send us up to 1 file for free decryption. - The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) ( How to obtain Bitcoins ) - The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. - https://localbitcoins.com/buy_bitcoins - Also you can find other places to buy Bitcoins and beginners guide here: - http://www.coindesk.com/information/how-can-i-buy-bitcoins/ - [ pewpew TEAM ]
Targets
-
- Target pewpew_p.bin
- Size 1.0MB
- SHA256 7282df1360af4c028930ffd9fbc30ea9d17f08f14b725f8020677dd9df961c55
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Windows Firewall
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies service
-
Suspicious use of NtSetInformationThreadHideFromDebugger