Overview

overview

10

Static

static

3

b0bf2b7e19...40.exe

windows7_x64

7

b0bf2b7e19...40.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0bf2b7e196b4a95fb48e2e3c721b66ec13b6552268c27083319110cc7651f40

  • Size

    11.9MB

  • Sample

    210406-q5qaxf7h9j

  • MD5

    a023ab8a5f09b94dc53dff53bf7dd0b4

  • SHA1

    4d37696c51b2750c012fc8a45fc72f497fb81db1

  • SHA256

    b0bf2b7e196b4a95fb48e2e3c721b66ec13b6552268c27083319110cc7651f40

  • SHA512

    79e14bcdd110b95dad95008433db2bdb2c2e66ee786ac4d64a24fed19bf5075515865502e9c975b1fe38a1b21cc1bb09ddd4ab716bd41679dbac156eeaba5831

Score
10/10
demonwarepyinstallerransomware

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\README.txt

Ransom Note
! ATTENTION ! ---------------------------------------------------------------------------------------------------- ! STRICTLY FORBIDDEN TO USE THIRD-PARTY DECRYPTION SOFTWARE - ALL YOUR FILES WILL BE LOST ! ---------------------------------------------------------------------------------------------------- Due to vulnerability in your system all files have been protected with a strong private key to safe them from unathorized access. You have 10HRS to get your key else all your files would be destroyed To RESTORE your files, Follow this instructions: 1. Gh0st service charges a payment for file decryption tool 2. Receive Gh0st file decryption tool and Unique decryption key 3. Run the tool and use your key to successfully RESTORE all your files ! WE GUARANTEE: 100% Successful restoring all of your files 100% Customers service and Satisfaction 100% Fast and secure services ---------------------------------------------------------------------------------------------------- ! ONLY ORIGINAL GH0ST DECRYPTION TOOL AND KEY CAN RESTORE YOUR FILES! ---------------------------------------------------------------------------------------------------- Contacts: EMAIL :- [email protected] TELEGRAM :- https://t.me/Bitcointoolz Payment accepted: Bitcoin (BTC) only Kind Regards,
URLs

https://t.me/Bitcointoolz

Targets

    • Target

      b0bf2b7e196b4a95fb48e2e3c721b66ec13b6552268c27083319110cc7651f40

    • Size

      11.9MB

    • MD5

      a023ab8a5f09b94dc53dff53bf7dd0b4

    • SHA1

      4d37696c51b2750c012fc8a45fc72f497fb81db1

    • SHA256

      b0bf2b7e196b4a95fb48e2e3c721b66ec13b6552268c27083319110cc7651f40

    • SHA512

      79e14bcdd110b95dad95008433db2bdb2c2e66ee786ac4d64a24fed19bf5075515865502e9c975b1fe38a1b21cc1bb09ddd4ab716bd41679dbac156eeaba5831

    Score
    10/10
    demonwareransomware

    • DemonWare

      Ransomware first seen in mid-2020.

      ransomwaredemonware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks