aa5b2a6a2711cde023d91112c0574f121b4edd6c8b62409155e75d36f38b0bb6

General

Target

Notice_to_Appear_00614075.doc.js
Size

37KB
Sample

210115-ajx4w7ys5e
MD5

f84c5242741ccd7949762ca5cbb96556
SHA1

894c726e0a3e8cf3fd98690c27f885c4aa775775
SHA256

aa5b2a6a2711cde023d91112c0574f121b4edd6c8b62409155e75d36f38b0bb6
SHA512

5f5716fdf73bd38f28e36cf2d8dc5a8b8ec613a3665e43e5103206fb1bc9f32ad8a44c40cea9cf037f609ad33579569b86c8fd2002832d1daf63218e27feab71

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\a.txt

Ransom Note

ATTENTION! All your documents, photos, databases and other important personal files were encrypted using strong RSA-1024 algorithm with a unique key. To restore your files you have to pay 0.47952 BTC (bitcoins). Please follow this manual: 1. Create Bitcoin wallet here: https://blockchain.info/wallet/new 2. Buy 0.47952 BTC with cash, using search here: https://localbitcoins.com/buy_bitcoins 3. Send 0.47952 BTC to this Bitcoin address: 16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB 4. Open one of the following links in your browser to download decryptor: http://sswboiler.com/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB http://bucataria-sylviei.ro/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB http://lifan-m.ru/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB http://www.czarnieckiliny.pl/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB http://demo3.twt.it/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB 5. Run decryptor to restore your files. PLEASE REMEMBER: - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES. - Nobody can help you except us. - It`s useless to reinstall Windows, update antivirus software, etc. - Your files can be decrypted only after you make payment. - You can find this manual on your desktop (DECRYPT.txt).

Wallets

16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB

URLs

http://sswboiler.com/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB

http://bucataria-sylviei.ro/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB

http://lifan-m.ru/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB

http://www.czarnieckiliny.pl/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB

http://demo3.twt.it/counter/?a=16UGRaKSk1LN9AeyLCS8qRLRb2nZwyNaHB

Targets

- Target
  
  Notice_to_Appear_00614075.doc.js
- Size
  
  37KB
- MD5
  
  f84c5242741ccd7949762ca5cbb96556
- SHA1
  
  894c726e0a3e8cf3fd98690c27f885c4aa775775
- SHA256
  
  aa5b2a6a2711cde023d91112c0574f121b4edd6c8b62409155e75d36f38b0bb6
- SHA512
  
  5f5716fdf73bd38f28e36cf2d8dc5a8b8ec613a3665e43e5103206fb1bc9f32ad8a44c40cea9cf037f609ad33579569b86c8fd2002832d1daf63218e27feab71
Score

10^/10

persistence ransomware spyware
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
behavioral1 behavioral2