Overview

overview

10

Static

static

avslker_97...89.exe

windows7_x64

10

avslker_97...89.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    avslker_97820cf8de59555d2d333ac724c6a72c610b8c537f35139ebb1a5a362e68f789

  • Size

    402KB

  • Sample

    210726-mfxzp75xxs

  • MD5

    208c45f500c299bc4ebd80d1e230cc41

  • SHA1

    1c0b42efd324cab1625423b5634ee4b67ad62ac5

  • SHA256

    97820cf8de59555d2d333ac724c6a72c610b8c537f35139ebb1a5a362e68f789

  • SHA512

    d34d6ffcb4751f0a5391fd08cd6c78ceb6bdcc9c4346b28cd8c0e00a1ab810e1990dd752b70852aaed73738c888e6d0d73485c1e58582e8d0aedc106551e2637

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\GET_YOUR_FILES_BACK.txt

Ransom Note
Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avos2fuj6olp6x36.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Hurry up, as the price may increase in the following days. If you fail to respond in a swift manner, we will leak your files in our press release/blog website accessible at http://avos53nnmi4u6amh.onion/ Message from agent: Data from HIBSSERV1118 was exfiltrated. This data will be leaked if we can't get a word back from you in 3 days. Your ID: 2aa81efb15920446a7e920d80afd1e9397a787295456bd5518c1f096345e61e1
URLs

http://avos2fuj6olp6x36.onion

http://avos53nnmi4u6amh.onion/

Targets

    • Target

      avslker_97820cf8de59555d2d333ac724c6a72c610b8c537f35139ebb1a5a362e68f789

    • Size

      402KB

    • MD5

      208c45f500c299bc4ebd80d1e230cc41

    • SHA1

      1c0b42efd324cab1625423b5634ee4b67ad62ac5

    • SHA256

      97820cf8de59555d2d333ac724c6a72c610b8c537f35139ebb1a5a362e68f789

    • SHA512

      d34d6ffcb4751f0a5391fd08cd6c78ceb6bdcc9c4346b28cd8c0e00a1ab810e1990dd752b70852aaed73738c888e6d0d73485c1e58582e8d0aedc106551e2637

    Score
    10/10
    ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks