General
- Target edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf
- Size 893KB
- Sample210528-zedj8r96b2
- SHA256 edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf
Score
10/10
Malware Config
Extracted
Path
-
\??\c:\teslarvng2.hta
Ransom Note
- all data in your machine turned to useless binary code your databses and important files have been downloaded and will be published after 12days if not paid to return files and prevent publishing email us at : [email protected] , [email protected] (send copy to both, your id as subject) your id : xUBLMi2I tips: no one else can help you ,don't waste your business time you ask for proof that we have your data ,and you can see our old target that their data have been published if not paid after 12days Google your Campany Name and you wil see your private and custorres data in there ,happy will legal and bussiness challenges of data leak after for decryption anyone/any company offering help will get extra fee(some times even more than ours!) added to ours or simplly will scam you (dont pay us after getting test file, lie and scam you) so if you want a Intermediary chose a trusted one to avoid scams , and get your data for decryption you send a few Sample files for test before any payment we won;t be available for long DONT DELETE FILES AT c:\teslarvng2 dont play with encrypted files that will corrupt them and make unrecoverable. due raas(it means the email you talk will give percentage to devs ) to avoid scam never pay anyone without testfile (us or any dealer),never ever pay outside of this 2 emails,ONLY PAY TO THE WALLET ADDRESS YOU RECEIVE WITH DECRYPTED SAMPLE FILE ,scam can't happen if this tips are followed . use google translate (if you don't know english)
Targets
-
- Target edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf
- Size 893KB
- SHA256 edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Creates new service(s)
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Stops running service(s)
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory