General

  • Target

    85763589171b520806c08fd836010a4ca264ffa3dbf428cc4797fefa9136a189

  • Size

    2.4MB

  • Sample

    210616-ghn2p9m9zj

  • MD5

    cbd92757051490316de527a02ac17947

  • SHA1

    7827b55923e1ac65a4d58871ad7574406a8aad53

  • SHA256

    85763589171b520806c08fd836010a4ca264ffa3dbf428cc4797fefa9136a189

  • SHA512

    4eb62d367b2d498f83af84e38671649cf35b09058320be880e29992ab7cff0df4216820ffdd2b0ebccb37ea46a3a0b335f32955fa26e9cbf4189e76466fd6d88

Malware Config

Extracted

Path

/storage/emulated/0/Android/obb/README.txt

Ransom Note
hey Down! Seems like you got hit by CoderWare ! warning: take a screenshot of this place. If you lose the information here, you'll never get to us. and it would be impossible to get your dosys Don't Panic, you get have your files back! CoderWare uses a basic encryption script to lock your files.This type of is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry.You have 10 hours to find your key When you pay >>> 500$ <<< to the Bitcoin address below, you will need to send a single as proof to our e-mail address, and if the receipt is correct, your code to decrypt our files to your e-mail address. It will be sent back to you via e-mail. But you have to be quick for that. Because you have 24 hours. If you do not pay within 10 hours, your files will be permanently deleted. And it would be out of reach again. If you don't know how to get bitcoin. https://buy.moonpay.io can quickly get your credit or debit card online from the website. Please type the bitcoin address shown on the screen in the wallet field on the website. If you try to shut it down by force, you'll lose your files. because if you lose your bitcoin address, you won't be able to pay. and you'll never get your files back. If you delete the application, it will be impossible to access your files. email: [email protected] bitcoin Adress : 336Fvf8fRrpySwq8gsaWdf7gfuGm5FQi8K telegram : @Codersan hey Down! Seems like you got hit by CoderWare ! warning: take a screenshot of this place. If you lose the information here, you'll never get to us. and it would be impossible to get your dosys Don't Panic, you get have your files back! CoderWare uses a basic encryption script to lock your files.This type of is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry.You have 10 hours to find your key When you pay >>> 500$ <<< to the Bitcoin address below, you will need to send a single as proof to our e-mail address, and if the receipt is correct, your code to decrypt our files to your e-mail address. It will be sent back to you via e-mail. But you have to be quick for that. Because you have 24 hours. If you do not pay within 10 hours, your files will be permanently deleted. And it would be out of reach again. If you don't know how to get bitcoin. https://buy.moonpay.io can quickly get your credit or debit card online from the website. Please type the bitcoin address shown on the screen in the wallet field on the website. If you try to shut it down by force, you'll lose your files. because if you lose your bitcoin address, you won't be able to pay. and you'll never get your files back. If you delete the application, it will be impossible to access your files. email: [email protected] bitcoin Adress : 336Fvf8fRrpySwq8gsaWdf7gfuGm5FQi8K telegram : @Codersan hey Down! Seems like you got hit by CoderWare ! warning: take a screenshot of this place. If you lose the information here, you'll never get to us. and it would be impossible to get your dosys Don't Panic, you get have your files back! CoderWare uses a basic encryption script to lock your files.This type of is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry.You have 10 hours to find your key When you pay >>> 500$ <<< to the Bitcoin address below, you will need to send a single as proof to our e-mail address, and if the receipt is correct, your code to decrypt our files to your e-mail address. It will be sent back to you via e-mail. But you have to be quick for that. Because you have 24 hours. If you do not pay within 10 hours, your files will be permanently deleted. And it would be out of reach again. If you don't know how to get bitcoin. https://buy.moonpay.io can quickly get your credit or debit card online from the website. Please type the bitcoin address shown on the screen in the wallet field on the website. If you try to shut it down by force, you'll lose your files. because if you lose your bitcoin address, you won't be able to pay. and you'll never get your files back. If you delete the application, it will be impossible to access your files. email: [email protected] bitcoin Adress : 336Fvf8fRrpySwq8gsaWdf7gfuGm5FQi8K telegram : @Codersan
Wallets

336Fvf8fRrpySwq8gsaWdf7gfuGm5FQi8K

Extracted

Path

/mnt/sdcard/README.txt

Ransom Note
hey Down! Seems like you got hit by CoderWare ! warning: take a screenshot of this place. If you lose the information here, you'll never get to us. and it would be impossible to get your dosys Don't Panic, you get have your files back! CoderWare uses a basic encryption script to lock your files.This type of is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry.You have 10 hours to find your key When you pay >>> 500$ <<< to the Bitcoin address below, you will need to send a single as proof to our e-mail address, and if the receipt is correct, your code to decrypt our files to your e-mail address. It will be sent back to you via e-mail. But you have to be quick for that. Because you have 24 hours. If you do not pay within 10 hours, your files will be permanently deleted. And it would be out of reach again. If you don't know how to get bitcoin. https://buy.moonpay.io can quickly get your credit or debit card online from the website. Please type the bitcoin address shown on the screen in the wallet field on the website. If you try to shut it down by force, you'll lose your files. because if you lose your bitcoin address, you won't be able to pay. and you'll never get your files back. If you delete the application, it will be impossible to access your files. email: [email protected] bitcoin Adress : 336Fvf8fRrpySwq8gsaWdf7gfuGm5FQi8K telegram : @Codersan
Wallets

336Fvf8fRrpySwq8gsaWdf7gfuGm5FQi8K

Targets

    • Target

      85763589171b520806c08fd836010a4ca264ffa3dbf428cc4797fefa9136a189

    • Size

      2.4MB

    • MD5

      cbd92757051490316de527a02ac17947

    • SHA1

      7827b55923e1ac65a4d58871ad7574406a8aad53

    • SHA256

      85763589171b520806c08fd836010a4ca264ffa3dbf428cc4797fefa9136a189

    • SHA512

      4eb62d367b2d498f83af84e38671649cf35b09058320be880e29992ab7cff0df4216820ffdd2b0ebccb37ea46a3a0b335f32955fa26e9cbf4189e76466fd6d88

    Score
    10/10

MITRE ATT&CK Matrix

Tasks