dc20c80a0c1db5848ceef6714c6d774f3002a0c595638aff0410ae2ddabb710a

General

Target

Delivery_Notification_00896328.doc.js
Size

248KB
Sample

210115-6zp7zwzspx
MD5

0168089428c6aa371f4275d0872b0970
SHA1

d2595c0a40c4d8dcf9f7c711f472abc6ac0f592e
SHA256

dc20c80a0c1db5848ceef6714c6d774f3002a0c595638aff0410ae2ddabb710a
SHA512

915d7a3f63429a27dace53418d8b3216ef3b4b6ac82d63ecca6f1590aa7380449fb4fe3ec8eed5a9aa3a8dadeed5ef32091ecdf2e885aca8d998d8150d07f418

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\a.txt

Ransom Note

ATTENTION! All your documents, photos, databases and other important personal files were encrypted using strong RSA-1024 algorithm with a unique key. To restore your files you have to pay 0.54309 BTC (bitcoins). Please follow this manual: 1. Create Bitcoin wallet here: https://blockchain.info/wallet/new 2. Buy 0.54309 BTC with cash, using search here: https://localbitcoins.com/buy_bitcoins 3. Send 0.54309 BTC to this Bitcoin address: 19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ 4. Open one of the following links in your browser to download decryptor: http://ferroli-lietuva.eu/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ http://georgina-collier.com/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ http://firstshow.info/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ http://gayathri.co.in/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ http://jackroubaud.com/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ 5. Run decryptor to restore your files. PLEASE REMEMBER: - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES. - Nobody can help you except us. - It`s useless to reinstall Windows, update antivirus software, etc. - Your files can be decrypted only after you make payment. - You can find this manual on your desktop (DECRYPT.txt).

Wallets

19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ

URLs

http://ferroli-lietuva.eu/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ

http://georgina-collier.com/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ

http://firstshow.info/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ

http://gayathri.co.in/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ

http://jackroubaud.com/counter/?a=19bKG2PuU8s4kjfqBYepN3yTuuKC2NEQbZ

Targets

- Target
  
  Delivery_Notification_00896328.doc.js
- Size
  
  248KB
- MD5
  
  0168089428c6aa371f4275d0872b0970
- SHA1
  
  d2595c0a40c4d8dcf9f7c711f472abc6ac0f592e
- SHA256
  
  dc20c80a0c1db5848ceef6714c6d774f3002a0c595638aff0410ae2ddabb710a
- SHA512
  
  915d7a3f63429a27dace53418d8b3216ef3b4b6ac82d63ecca6f1590aa7380449fb4fe3ec8eed5a9aa3a8dadeed5ef32091ecdf2e885aca8d998d8150d07f418
Score

10^/10

persistence ransomware spyware
- Blocklisted process makes network request
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
behavioral1 behavioral2