17d8dc4f6931ece4a4da2d0ac7ccf8ebbb09cbd153aef1ee5e575656a9d95769

General

Target

12e66476395f8c1d0c457a7c13ae71df.zip
Size

662KB
Sample

210319-vh1g38919e
MD5

a4d5bfbaedd923f04011197f66ae5863
SHA1

a952ae3befd3fc32128f3a39173c225320ec2ee8
SHA256

17d8dc4f6931ece4a4da2d0ac7ccf8ebbb09cbd153aef1ee5e575656a9d95769
SHA512

e89a5c2afd6569bae7ad96fb0189376f12027d76911219ef193db54c97e4c1f06124d88b46826d78b216c327acc83b3462142eb04ff269bcbd3983b60628069a

Score

10^/10

Malware Config

Extracted

Path

C:\_readme.txt

Ransom Note

ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-2w03ajSkK1 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: helpteam@mail.ch Reserve e-mail address to contact us: helpmanager@airmail.cc Your personal ID: 0282oPsw32f4OfOSHaJTDMA9o58Df7yU9jUpxyfWKcEPew2t1

Emails

helpteam@mail.ch

helpmanager@airmail.cc

URLs

https://we.tl/t-2w03ajSkK1

Targets

- Target
  
  12e66476395f8c1d0c457a7c13ae71df
- Size
  
  737KB
- MD5
  
  12e66476395f8c1d0c457a7c13ae71df
- SHA1
  
  8cb6d53b8b238c0118a0b4748ec54c9aa49123b7
- SHA256
  
  9bf5a22089f0b74627320945df991bd1dfa37bf5522f8ecb61e5873bc6093f22
- SHA512
  
  7e80d1b0b45f2f076499d93ef1d810e4a5ad4a4fe5a7156de4cb1a1be1beb779d39912c802a1bead6bbae7f4ce6f8cf64d49441e0d4c12fc488f1d1d90b9150c
Score

10^/10

discovery persistence ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2