General

  • Target

    1.exe

  • Size

    2.7MB

  • Sample

    201109-6xljjz9eyj

  • MD5

    5a4135a79283d211cf21820a67e01a4f

  • SHA1

    fd1a1709b4346a4ca307d01cb85b5d6beb633733

  • SHA256

    2ba2c20a826f51ed753f4f4dd78118d6f371a2fd5b4b0a2ff640c8f046d4fb55

  • SHA512

    c6aa36b7326a461179dc0c8c14dc3552ccbf22d72490ee1d7ca90b3c9177538eff8e16258a2e42ab59b4c5999c25e420981dfc9e2fb6d4a1cc509c2c9534813b

Malware Config

Extracted

Path

C:\How_To_Decrypt_Files.txt

Ransom Note
All Your Files Has Been Locked! Finding a way to decrypt the file makes us happy but all your files are protected by strong encryption with AES RSA 256 using military-grade encryption algorithm This is a private ransomware developed by our team and there is no decryption file for it In our view it is not possible to decrypt without a key Your (Unique decryption file) For Trust You can Send us Test Files And We Decrypt That And Send To You. The time of our country may be different from yours, so be patient, we will answer you as soon as possible. Email addresses are blocked quickly, so contact us sooner The first email may be blocked, so contact all of the following emails Your unique Id : WDHJFRVD Contact us : [email protected] [email protected] If you do not receive a reply from us, please contact us via Telegram Secure Messenger Telegram ID : http://t.me/yourfile2020 Short video on how to decrypt files: https://streamable.com/7h914 What are the guarantees that I can decrypt my files after paying the ransom? Your main guarantee is the ability to decrypt test files. This means that we can decrypt all your files after paying the ransom. We have no reason to deceive you after receiving the ransom, since we are not barbarians and moreover it will harm our business. You Have 24 hours to Decide to Pay after 2 Days Decryption Price will Be Double And after 1 week it will be triple Try to Contact late and You will know Therefore, we recommend that you make payment within a few hours. Those who get in touch with us faster We also mention your security issues and how to get hacked so that you won't be hacked again by others. It's just a business
URLs

http://t.me/yourfile2020

https://streamable.com/7h914

Targets

    • Target

      1.exe

    • Size

      2.7MB

    • MD5

      5a4135a79283d211cf21820a67e01a4f

    • SHA1

      fd1a1709b4346a4ca307d01cb85b5d6beb633733

    • SHA256

      2ba2c20a826f51ed753f4f4dd78118d6f371a2fd5b4b0a2ff640c8f046d4fb55

    • SHA512

      c6aa36b7326a461179dc0c8c14dc3552ccbf22d72490ee1d7ca90b3c9177538eff8e16258a2e42ab59b4c5999c25e420981dfc9e2fb6d4a1cc509c2c9534813b

    Score
    10/10
    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • JavaScript code in executable

MITRE ATT&CK Enterprise v6

Tasks