Overview

overview

10

Static

static

6

c81c2c539c...le.exe

windows7_x64

10

c81c2c539c...le.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample
  • Size 3.0MB
  • Sample201210-bknpcabj6e
  • SHA256 c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e
  • MD5 SHA1 SHA512
Score
10/10
ransomware

Malware Config

Extracted

Path

  • C:\$Recycle.Bin\INFECTION-HELP.txt

Ransom Note
  • Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: [email protected] [email protected] [email protected]
URLs

  • http://corpleaks.net

  • http://hxt254aygrsziejn.onion

Targets

    • Target
      c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample
    • Size 3.0MB
    • SHA256 c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks