Overview

overview

10

Static

static

918cc7b135...38.exe

windows7_x64

10

918cc7b135...38.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    918cc7b13539fa40464b0f6109d62c7092d3c6bf57f4dfddd2e0e20eeac6e838

  • Size

    402KB

  • Sample

    210727-vzj578st4n

  • MD5

    577bc98ed6308f96a27ff156f304a125

  • SHA1

    b19d7b107e980dbba50c6a2d99c9aeadc257e48f

  • SHA256

    918cc7b13539fa40464b0f6109d62c7092d3c6bf57f4dfddd2e0e20eeac6e838

  • SHA512

    83512f274fdfb71bdb7898d97eb77085b1da3f785d59f9790b6cdcdaf13cdc8e582731434a67fafea1651b1dde75957ca8896a058d73bbe6e1a35ad31f7b624b

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\GET_YOUR_FILES_BACK.txt

Ransom Note
Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avos2fuj6olp6x36.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Hurry up, as the price may increase in the following days. If you fail to respond in a swift manner, we will leak your files in our press release/blog website accessible at http://avos53nnmi4u6amh.onion/ Your ID: e3a71975215dd4b2f2eaa0544a1a464e7daf336fddff5a5291a699e5de86c107
URLs

http://avos2fuj6olp6x36.onion

http://avos53nnmi4u6amh.onion/

Targets

    • Target

      918cc7b13539fa40464b0f6109d62c7092d3c6bf57f4dfddd2e0e20eeac6e838

    • Size

      402KB

    • MD5

      577bc98ed6308f96a27ff156f304a125

    • SHA1

      b19d7b107e980dbba50c6a2d99c9aeadc257e48f

    • SHA256

      918cc7b13539fa40464b0f6109d62c7092d3c6bf57f4dfddd2e0e20eeac6e838

    • SHA512

      83512f274fdfb71bdb7898d97eb77085b1da3f785d59f9790b6cdcdaf13cdc8e582731434a67fafea1651b1dde75957ca8896a058d73bbe6e1a35ad31f7b624b

    Score
    10/10
    ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks