a78511360d97a807f3eed73e1c20e7e3e43df5323ba85b1123a2b2dfc34d14bc

General

Target

00976648.doc.js
Size

37KB
Sample

210115-7ap3ptd926
MD5

d0abb083c074da24b66f64adbba63096
SHA1

db2f991db8c4885c00e0cf07a1b87e4f79b26381
SHA256

a78511360d97a807f3eed73e1c20e7e3e43df5323ba85b1123a2b2dfc34d14bc
SHA512

3fc97f179b61b57ea4842bde292f72fd7c815967cb0f8317139358e14378792a9b05f6dd5417a241e56c4610f7ea7a9ef1e15c8f55dc0a01b07286b9140ae03d

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\a.txt

Ransom Note

ATTENTION! All your documents, photos, databases and other important personal files were encrypted using strong RSA-1024 algorithm with a unique key. To restore your files you have to pay 0.61251 BTC (bitcoins). Please follow this manual: 1. Create Bitcoin wallet here: https://blockchain.info/wallet/new 2. Buy 0.61251 BTC with cash, using search here: https://localbitcoins.com/buy_bitcoins 3. Send 0.61251 BTC to this Bitcoin address: 1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD 4. Open one of the following links in your browser to download decryptor: http://www.mariaberdun.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD http://sandrahalbe.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD http://inothim.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD http://lmapp360.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD http://glamcook.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD 5. Run decryptor to restore your files. PLEASE REMEMBER: - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES. - Nobody can help you except us. - It`s useless to reinstall Windows, update antivirus software, etc. - Your files can be decrypted only after you make payment. - You can find this manual on your desktop (DECRYPT.txt).

Wallets

1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD

URLs

http://www.mariaberdun.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD

http://sandrahalbe.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD

http://inothim.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD

http://lmapp360.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD

http://glamcook.com/counter/?a=1GwdpreN2MM9uHt46kEDp4geDC86CFyTzD

Targets

- Target
  
  00976648.doc.js
- Size
  
  37KB
- MD5
  
  d0abb083c074da24b66f64adbba63096
- SHA1
  
  db2f991db8c4885c00e0cf07a1b87e4f79b26381
- SHA256
  
  a78511360d97a807f3eed73e1c20e7e3e43df5323ba85b1123a2b2dfc34d14bc
- SHA512
  
  3fc97f179b61b57ea4842bde292f72fd7c815967cb0f8317139358e14378792a9b05f6dd5417a241e56c4610f7ea7a9ef1e15c8f55dc0a01b07286b9140ae03d
Score

10^/10

persistence ransomware
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- JavaScript code in executable
behavioral1 behavioral2