netwalker | 0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378

General

Target

0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
Size

57KB
MD5

dd4f9213ba67c26add74eae8c8b8bd8c
SHA1

f7b6dbbe8bdf004cbe39abdbd510511f81f68933
SHA256

0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378
SHA512

58e0b92d5c300378416cba1642d1b05de5aa3598cd87ac3e04b0c1e72cb2c19b1c3f0a2cccb11a531a4eeac0bfb786f6ad3b7d1379191fe7ab4253163c8d76f9

Score

10^/10

netwalker ransomware spyware

Malware Config

Extracted

Path

C:\8E6BA8-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\odt\8E6BA8-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\8E6BA8-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\8E6BA8-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\8E6BA8-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .8e6ba8 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8e6ba8: c6HtHcOG0AZkpIeZ8bq3D4FBt6hVFa5gr2DXMj6P0x0TSskx8V 7V+r5FSRT26DwxYeKFOzjjmDxg958g1vWuWP7GIv0Fx9AUNPbn hwBC/aLpMJBFPqxkwZeqV4Gc92isilPprTKBvu93r1s9h1i4bE xdqVNSf5cQdAMngsngU+A+30JjsCViWw+HOcdpjt4PVEW+GYIT 2VC9NUow2E494dRG9FVuRqRxjxUzDpzhur0N3B8lAOLRqfHLSG KcjsldXEYyNpa0/fjYvw1ZU42apuxwv6BVPn7HWA==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Signatures

Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
ransomware netwalker

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\CompressMount.tiff => C:\Users\Admin\Pictures\CompressMount.tiff.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File renamed	C:\Users\Admin\Pictures\ConvertExit.raw => C:\Users\Admin\Pictures\ConvertExit.raw.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File renamed	C:\Users\Admin\Pictures\RevokePush.tiff => C:\Users\Admin\Pictures\RevokePush.tiff.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File renamed	C:\Users\Admin\Pictures\SyncEdit.tiff => C:\Users\Admin\Pictures\SyncEdit.tiff.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File renamed	C:\Users\Admin\Pictures\DismountResume.png => C:\Users\Admin\Pictures\DismountResume.png.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File renamed	C:\Users\Admin\Pictures\RenamePing.png => C:\Users\Admin\Pictures\RenamePing.png.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Users\Admin\Pictures\CompressMount.tiff	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Users\Admin\Pictures\RevokePush.tiff	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File renamed	C:\Users\Admin\Pictures\StepCompress.tif => C:\Users\Admin\Pictures\StepCompress.tif.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File renamed	C:\Users\Admin\Pictures\UndoSplit.tif => C:\Users\Admin\Pictures\UndoSplit.tif.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File renamed	C:\Users\Admin\Pictures\BackupMeasure.crw => C:\Users\Admin\Pictures\BackupMeasure.crw.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Users\Admin\Pictures\SyncEdit.tiff	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File renamed	C:\Users\Admin\Pictures\UpdateMerge.raw => C:\Users\Admin\Pictures\UpdateMerge.raw.8e6ba8	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 17165 IoCs

Processes:

0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\8E6BA8-Readme.txt	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\8E6BA8-Readme.txt	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-80_altform-unplated.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-1.jpg	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-96_altform-unplated.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-150.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-16.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\Square44x44Logo.targetsize-256.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\8E6BA8-Readme.txt	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\ui-strings.js	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-100.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-20.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-200.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-16_altform-unplated.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\heart.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\show_icon.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\ui-strings.js	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_fi_135x40.svg	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\en-gb\DemoNotebook.onepkg	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_achievements.targetsize-48.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\ui-strings.js	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\THMBNAIL.PNG	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\ui-strings.js	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\8E6BA8-Readme.txt	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\AppxManifest.xml	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsMedTile.scale-125.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\Icons_Icon_PoP_sm.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\8E6BA8-Readme.txt	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6365_24x24x32.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-200.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\cn_60x42.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\DailyChallenges\tile5_diamond.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\8E6BA8-Readme.txt	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Jumbo\jumbo_13d.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Generic.xbf	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\_Resources\index.txt	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\SkypeApp\Assets\SkypeLargeTile.scale-100_contrast-black.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-64.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\MedTile.scale-200.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\ui-strings.js	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview-hover.svg	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-30_altform-unplated_contrast-white.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-200_contrast-white.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe

Suspicious behavior: EnumeratesProcesses 3018 IoCs

Processes:

0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe

pid	process
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe

description	pid	process
Token: SeDebugPrivilege	1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
Token: SeImpersonatePrivilege	1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe

description	pid	process	target process
PID 1304 wrote to memory of 4880	1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe	notepad.exe
PID 1304 wrote to memory of 4880	1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe	notepad.exe
PID 1304 wrote to memory of 4880	1304	0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe
"C:\Users\Admin\AppData\Local\Temp\0afd99c3f7593c760c4001313963f3e7fd709ca56046044033d790602a8cb378.exe"
1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\notepad.exe
  C:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\8E6BA8-Readme.txt"
  2⤵
  PID:4880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\8E6BA8-Readme.txt

MD5
1b00a849a1f17774097614fa82ccd74b

SHA1
fc02ff09bc1b45fec74d98e8f1da626d0da9daca

SHA256
e0ec79354b88b7d0d52d63983b6e09cc25b17187ed3e597f8900f6c4fbf9fd19

SHA512
952891ae4bf5d926e550324d9878e61899a4a0cc46da7bc7220620f8cc2f12a921f2543cd121354380c0930020096de7ee043dd2b6cc9680c694e13f285965bc

Download Submit
memory/4880-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads