bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a

General

Target

bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a.bin
Size

11KB
Sample

210118-8825mdkdsn
MD5

f3d78f15bf85aa14f71979585d310ae7
SHA1

1e73b89abd5e0e0e74291d5ebb4f10574a9ef2e2
SHA256

bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a
SHA512

ef251e35c6047df225d937b568ded6ad9ee8e72235fac6ce6c04e9287f01aad65c63ada7e65e304ac094029f0a768d2697c3960dde818f7cf0f73cd81283e087

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\READ_ME.hta

Ransom Note

E P S I L O N Ransomware ⠀ As you can see, all your files got encrypted. Thats why your files are no longer readable. If you want them back, please contact us at our email below. You can send us a couple of files and we will return the restored ones to prove that only we can do it. [email protected] You can ask for more details and more help by email. You can learn more about bitcoin and encryption on wikipedia. https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption ⠀ If you already submited your payement, you will receive your private key and another decryption key with the special decryption software. More informations: 1. the infection was due to vulnerabilities in your software. 2. our goal is to return your data, but if you don't contact us, we will not succeed. IMPORTANT: 1. if you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 2. only communication through our email can guarantee file recover for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 3. please, do not try to rename encrypted files.

Emails

[email protected]

URLs

https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption

Targets

- Target
  
  bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a.bin
- Size
  
  11KB
- MD5
  
  f3d78f15bf85aa14f71979585d310ae7
- SHA1
  
  1e73b89abd5e0e0e74291d5ebb4f10574a9ef2e2
- SHA256
  
  bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a
- SHA512
  
  ef251e35c6047df225d937b568ded6ad9ee8e72235fac6ce6c04e9287f01aad65c63ada7e65e304ac094029f0a768d2697c3960dde818f7cf0f73cd81283e087
Score

10^/10

persistence ransomware spyware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2