e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f

General

Target

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Size

7KB
Sample

210419-2whtww27bn
MD5

be6be1c81865e4eb75d01a918812ddea
SHA1

1482d68b097f8ff8c6257a754d7d452b0e34829f
SHA256

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f
SHA512

ea13391c0fd196486ed40cf359e18995f787a8e46a568f9795ab113757def02ba8f5536a48739c77c9fd2c4eaf763713b31a2e5ebeb0cbab644119d62406ec21

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\HOW TO DECRYPT FILES.txt

Ransom Note

Your files have been encrypted with our software. Photos, documents etc ... WHAT I CAN DO?? You can pay $ 20 in bitcoins to this address: 3QgJDoVEaksAs9kFz1vcueG8DKF4hPrARW As soon as you have made the payment, contact us in this email and we will give you the password bufalo@boximail.com *IMPORTANT* You must have proof of payment

Emails

bufalo@boximail.com

Wallets

3QgJDoVEaksAs9kFz1vcueG8DKF4hPrARW

Targets

- Target
  
  e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
- Size
  
  7KB
- MD5
  
  be6be1c81865e4eb75d01a918812ddea
- SHA1
  
  1482d68b097f8ff8c6257a754d7d452b0e34829f
- SHA256
  
  e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f
- SHA512
  
  ea13391c0fd196486ed40cf359e18995f787a8e46a568f9795ab113757def02ba8f5536a48739c77c9fd2c4eaf763713b31a2e5ebeb0cbab644119d62406ec21
Score

10^/10

persistence ransomware spyware stealer
- Drops file in Drivers directory
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2