edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf

General

Target

edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf
Size

893KB
Sample

210528-zedj8r96b2
MD5

8856669b9a76eeb19e5673db6c4491ab
SHA1

2d328721640ebb3ddeb971316141fd2b3a84ae84
SHA256

edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf
SHA512

96af5e42d4aab9ffbe10f4db0e2811d7e00ceebed7ed52b8e679164a92011bfa8eb7c33864be3b3e92358ba3b30ba87bab25cde9ee9163b325a7b542eea621e3

Score

10^/10

Malware Config

Extracted

Path

\??\c:\teslarvng2.hta

Ransom Note

all data in your machine turned to useless binary code your databses and important files have been downloaded and will be published after 12days if not paid to return files and prevent publishing email us at : [email protected] , [email protected] (send copy to both, your id as subject) your id : xUBLMi2I tips: no one else can help you ,don't waste your business time you ask for proof that we have your data ,and you can see our old target that their data have been published if not paid after 12days Google your Campany Name and you wil see your private and custorres data in there ,happy will legal and bussiness challenges of data leak after for decryption anyone/any company offering help will get extra fee(some times even more than ours!) added to ours or simplly will scam you (dont pay us after getting test file, lie and scam you) so if you want a Intermediary chose a trusted one to avoid scams , and get your data for decryption you send a few Sample files for test before any payment we won;t be available for long DONT DELETE FILES AT c:\teslarvng2 dont play with encrypted files that will corrupt them and make unrecoverable. due raas(it means the email you talk will give percentage to devs ) to avoid scam never pay anyone without testfile (us or any dealer),never ever pay outside of this 2 emails,ONLY PAY TO THE WALLET ADDRESS YOU RECEIVE WITH DECRYPTED SAMPLE FILE ,scam can't happen if this tips are followed . use google translate (if you don't know english)

Emails

[email protected]

Targets

- Target
  
  edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf
- Size
  
  893KB
- MD5
  
  8856669b9a76eeb19e5673db6c4491ab
- SHA1
  
  2d328721640ebb3ddeb971316141fd2b3a84ae84
- SHA256
  
  edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf
- SHA512
  
  96af5e42d4aab9ffbe10f4db0e2811d7e00ceebed7ed52b8e679164a92011bfa8eb7c33864be3b3e92358ba3b30ba87bab25cde9ee9163b325a7b542eea621e3
Score

10^/10

persistence ransomware evasion spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Creates new service(s)
  persistence
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Stops running service(s)
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2