ako

General

Target
a6ba509923864b65a437047e8a53d249c68025f4e29eb3efe0ebe16761d28667.sample
Size 591KB
Sample210726-klf94lf17j
SHA256 a6ba509923864b65a437047e8a53d249c68025f4e29eb3efe0ebe16761d28667
MD5 f7186597308adb3a78d356e159ce18b0
SHA1 56144f920cc510473c2cbe0124341efad7a43396
SHA512 afab4bf3921522629251a9d2dc1cdf332fdd16568b85f952b8ac7c1405cce00a30874bd3d5f6f50c45824584508f9a04d556f22ea27e6d4c2dd27d06e9c460f3
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ako-readme.txt

ako

Ransom Note

Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .j3GT9h Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuajNHVDloIiwgImtleSI6IjlPa1ZPL2pDNGdNZlRPNWRpRC9EQUk 4eEN1MWRhQmVBTklma3lKeHFsbGlGVWhIMXFBNUU2QS83Q1FZK0hEM3pwd3htT VF5QUVyUmJRTWlvTGMzRlRjcCtlR1UyMUdIdDYxZFR5Ym1DclFoUGQxQWc0eFV aNWFUMkd5bzk0WUh1WDMySE00NEdiT0tJQmJNTFVHNjJSS3VjUHQvZDJxYzlja Ud3cTJRenUxcDBsZ2pDMDZ0enRGSVRsSUlFLzJCNzdPUmRqTnc4SzhZUGJzaFN zYVowODRxeVdLeDJqbTVMci9nU0lJOVlIdjhNTHhEQ0lJeXN1UjIxSldGUHhJZ 09VNXB1bCtLVkZNaG1IOUxJaWw0N2x2d1lmeldXaTZtTm5TVXVrWHJhK1JxTzg 4bDYzTjJpOFhYTlZuVkJmS2o2SmxJSXd5eVF1VXpDMW1IVEY2UTFNdz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---

URLs

http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN

Extracted

Path

C:\Boot\ako-readme.txt

ako

Ransom Note

Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .EjdOlL Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuRWpkT2xMIiwgImtleSI6Ik5OcUFKcS9Pei83WW5HMVNwQ0pXWkJ iQ0pEMWE2TWNmWEIzUXh5T3BMOU9jbnRVVFVRM3MvYVNPeGNmb01GcGFqSnYzZ TBFVzNpUmtheDdGUytGR1c1VWt4QnNoTDF4eFQxZnViU3NickFhSmdCaHpOd29 EelZrSGRHS3ZHQjY3bkhWV3I2ZE5KdjhBRkErTjJrNzhYNFJ0M056VEs0MGRMU WpnT2Z6ZHVNc2o4akpYbmNqNzBKRkt4U0p3aTdlamNtcFJWTlZveE1LYUVIUEd 0QUtSa0pPK2k1R3NLdGVBcHNTNXhJYjI4eFhrbU9rSnlFMU5SY1RPQVl4czd2U HVLcm1YRTZDYzVHbW0zeUJ3cmZOWm5NY2VORkRFb0wybEtBM1hWcFNGSGlNOUt QY2ZaMHQ3NzdiZ3dKSHVLSG4wV3VSUi93RGs3K3o3c3BjSmh3NmZ0UT09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---

URLs

http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN

Targets

- Target
  a6ba509923864b65a437047e8a53d249c68025f4e29eb3efe0ebe16761d28667.sample
- Size 591KB
- SHA256 a6ba509923864b65a437047e8a53d249c68025f4e29eb3efe0ebe16761d28667
- MD5 f7186597308adb3a78d356e159ce18b0
- SHA1 56144f920cc510473c2cbe0124341efad7a43396
- SHA512 afab4bf3921522629251a9d2dc1cdf332fdd16568b85f952b8ac7c1405cce00a30874bd3d5f6f50c45824584508f9a04d556f22ea27e6d4c2dd27d06e9c460f3
- MD5 SHA1 SHA512
Score

10^/10

ako ransomware spyware stealer
- Ako
  Ransomware strain discovered in early 2020.
  ransomware ako
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2