23d7693284e90b752d40f8c0c9ab22da45f7fe3219401f1209c89ac98a4d7ed3

General

Target

23d7693284e90b752d40f8c0c9ab22da45f7fe3219401f1209c89ac98a4d7ed3.sample
Size

57KB
Sample

210726-h5npgv2nws
MD5

d38f63c08174dba2225a8c8293e4fd8b
SHA1

4c6e634075781724cba954a76d1d831d077b7257
SHA256

23d7693284e90b752d40f8c0c9ab22da45f7fe3219401f1209c89ac98a4d7ed3
SHA512

24c79e1e179983589296b5c5e131e1d32b103beabf48d7fb643738f833e8072fd14840239f261357d6731f9d7916aae5c95f02d94a603039684e0bfd4a8333c8

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt

Ransom Note

Ransomware Note : 1 - What Happened to My Computer ? Your business is at serious risk. There is a significant hole in the security system of your company. We've easily penetrated your network and now all your files, documents, photos, databases, ...are safely encrypted with the strongest millitary algorithms RSA4096 and AES-256. No one can help you to restore files without our special decoder (thanatos decryption). We have also uploaded a lot of files from your network on our secure server, so if you refuse to pay the ransom,those files will be published or solded to competitors. 2 - Can I Recover My Files ? Sure, we guarantee that you can recover all your files safely. If you want to restore your files write to recoba90@protonmail.com and attach 2 encrypted files (Less than 2MB each) and we will decrypt them. Please don't forget to precise the name of your compagny and your unique identifier key in the e-mail. But if you want to decrypt all your files, you need to pay. You only have 5 days from this moment to submit the payment. After that all your files will be lost definitely. 3 - How Do I Pay ? Payment is accepted in bitcoin only. You can buy bitcoins from : -https://www.coinbase.com -https://localbitcoins.com The final price of decryption is 1500$ . First : Send the bitcoin. Second: send an e-mail to recoba90@protonmail.com and don't forget to precise the name of you compagny, your wallet ID and your unique identifier key. After that, we will send you our thanatos decryption tool to restore all your files. !!!!Be warned, we won't be able to recover your files if your start fiddling with them.!!!! thanatos ransomware No System Is Safe Addressto send the BTC: 32bzWrWXXbWGSwB4gGTQt8RdzuNQVaS9Md Unique Identifier Key (must be sent to us together with proof of payment): ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ R+eZUByfO6OT0CqZeFuWyL8ezeMVPK+Q9h3gu/zDTZI7SA3rRQigDxKHvtBNSwr9BmdWkUxsivRznJpEqf6rRELYSTbs1ePLrsvxIAH3hBwqwX7Xp2QDqXh3SJmPPcDGnMcOzQ6IahdiXG8Ix+7lCrGwfYUEeKdPQAnh+x6KlZU44zNDioxOWeoQE1htSevWjTglGIcQPezRAHy6/+c1jiAUUA5uVEvOF3Y7tmunlPaYzsEdapUj7c3SDqTzNFmzQEmibid/695JS2XFZ7kbdUDFlhHWF3twqpIZaQ4yBqRvmfxAh1o0TNr+DiO6TKxZhd41E4sUSyPwo+1Nu4EFAQ== ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Number of files that you could have potentially lost forever can be as high as: 83

Emails

recoba90@protonmail.com

Wallets

32bzWrWXXbWGSwB4gGTQt8RdzuNQVaS9Md

Extracted

Credentials

Protocol: ftp
Host:
files.000webhost.com
Port:
21
Username:
recoba90

Targets

- Target
  
  23d7693284e90b752d40f8c0c9ab22da45f7fe3219401f1209c89ac98a4d7ed3.sample
- Size
  
  57KB
- MD5
  
  d38f63c08174dba2225a8c8293e4fd8b
- SHA1
  
  4c6e634075781724cba954a76d1d831d077b7257
- SHA256
  
  23d7693284e90b752d40f8c0c9ab22da45f7fe3219401f1209c89ac98a4d7ed3
- SHA512
  
  24c79e1e179983589296b5c5e131e1d32b103beabf48d7fb643738f833e8072fd14840239f261357d6731f9d7916aae5c95f02d94a603039684e0bfd4a8333c8
Score

10^/10

evasion ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2