Overview

overview

10

Static

static

6.exe_.exe

windows7_x64

10

6.exe_.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6.exe_.zip
  • Size 10KB
  • Sample201030-ch8c2ebwn6
  • SHA256 5cde9226d6c85859acb22a31c175196775f60927706807ccea4146767b36f856
  • MD5 SHA1 SHA512
Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

  • C:\Users\Admin\Pictures\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note
  • Oops All Of your important files were encrypted Like document pictures videos etc.. Don't worry, you can return all your files! All your files, documents, photos, databases and other important files are encrypted by a strong encryption. How to recover files? RSA is a asymmetric cryptographic algorithm, you need one key for encryption and one key for decryption so you need private key to recover your files. It’s not possible to recover your files without private key. The only method of recovering files is to purchase an unique private key.Only we can give you this key and only we can recover your files. What guarantees you have? As evidence, you can send us 1 file to decrypt by email We will send you a recovery file Prove that we can decrypt your file Please You must follow these steps carefully to decrypt your files: Send $200 worth of bitcoin to wallet: 3GDa7CcSjsW7Q29b16NiZ6DKxWauhJmKKq after payment,we will send you Decryptor software contact email: [email protected] Your personal ID: d09TwldPIleGCR2Y1zdbtIoE64jLQTrKMQfIhztxUqd4j3PCaIGCeNqrxj1ZBQa/MZd+ProqyE6NQmq7tOfrl4EtnfZn+5catCOgp8Rnohnq97ELsWjoUTXPdLejXeSbPOBXp804zv6pJuLtvO1LAfJ0qm1lMFCur0R9JSttCbA=
Wallets

  • 3GDa7CcSjsW7Q29b16NiZ6DKxWauhJmKKq

Extracted

Path

  • C:\Users\Admin\Pictures\Camera Roll\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note
  • Oops All Of your important files were encrypted Like document pictures videos etc.. Don't worry, you can return all your files! All your files, documents, photos, databases and other important files are encrypted by a strong encryption. How to recover files? RSA is a asymmetric cryptographic algorithm, you need one key for encryption and one key for decryption so you need private key to recover your files. It’s not possible to recover your files without private key. The only method of recovering files is to purchase an unique private key.Only we can give you this key and only we can recover your files. What guarantees you have? As evidence, you can send us 1 file to decrypt by email We will send you a recovery file Prove that we can decrypt your file Please You must follow these steps carefully to decrypt your files: Send $200 worth of bitcoin to wallet: 3GDa7CcSjsW7Q29b16NiZ6DKxWauhJmKKq after payment,we will send you Decryptor software contact email: [email protected] Your personal ID: MqawDKND1v+qQAUAM4WxE1CJILBXVt3GuBkCWV1tZxpInX4dxOZzY2Rp2wBmz7gfgv/FF5OX34S0zF/PL5OfgrXrNlqRpIQbmpD+8VgKY3/M5/LaqdICD0xr7W7ZCq3PNweIRzV2YppQEKbUxww9EuESQjV97v/0l1gySCm7YBk=
Wallets

  • 3GDa7CcSjsW7Q29b16NiZ6DKxWauhJmKKq

Targets

    • Target
      6.exe_
    • Size 26KB
    • SHA256 e404f26379df9df89844dbd55120dccf383c3b793e0f08d84ee40f82d0cc334a
    • MD5 SHA1 SHA512
    Score
    10/10
    evasionpersistenceransomwaretrojan

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks