General

  • Target

    rw2.exe

  • Size

    8.8MB

  • Sample

    210812-e2vccbsb6x

  • MD5

    8153d7448499d6c92ec77e4b18806631

  • SHA1

    3b14d25336d9bc90ad5c7f71a70302c079e08e9f

  • SHA256

    a0f0323b47c33182225625a6d21afe22082738edde97049229d1202758c3e62c

  • SHA512

    067691f8acc3cc55d6d20dd215ae7ac9d1b89bafe81ec89ee121de691265205370c2fbb724bcd15c0a8096f2b888ca77c6e5d50cff72e5a6e70809f6f04aa0e9

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RANSOM_NOTE.txt

Ransom Note
The harddisks of your computer have been encrypted with an Military grade encryption algorithm. There is no way to restore your data without a special key. Only we can decrypt your files! To purchase your key and restore your data, please follow these three easy steps: 1. Email the file called EMAIL_ME.txt at C:\Users\AdminDesktop\EMAIL_ME.txt to GetYourFilesBack@protonmail.com 2. You will recieve your personal BTC address for payment. Once payment has been completed, send another email to GetYourFilesBack@protonmail.com stating "PAID". We will check to see if payment has been paid. 3. You will receive a text file with your KEY that will unlock all your files. IMPORTANT: To decrypt your files, place text file on desktop and wait. Shortly after it will begin to decrypt all files. WARNING: Do NOT attempt to decrypt your files with any software as it is obselete and will not work, and may cost you more to unlcok your files. Do NOT change file names, mess with the files, or run deccryption software as it will cost you more to unlock your files- -and there is a high chance you will lose your files forever. Do NOT send "PAID" button without paying, price WILL go up for disobedience. Do NOT think that we wont delete your files altogether and throw away the key if you refuse to pay. WE WILL.
Emails

GetYourFilesBack@protonmail.com

Targets

    • Target

      rw2.exe

    • Size

      8.8MB

    • MD5

      8153d7448499d6c92ec77e4b18806631

    • SHA1

      3b14d25336d9bc90ad5c7f71a70302c079e08e9f

    • SHA256

      a0f0323b47c33182225625a6d21afe22082738edde97049229d1202758c3e62c

    • SHA512

      067691f8acc3cc55d6d20dd215ae7ac9d1b89bafe81ec89ee121de691265205370c2fbb724bcd15c0a8096f2b888ca77c6e5d50cff72e5a6e70809f6f04aa0e9

    Score
    10/10
    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks