Overview

overview

10

Static

static

3

af0366a8e1...12.exe

windows7_x64

10

af0366a8e1...12.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af0366a8e19aafc48efd00205417ad12

  • Size

    6.8MB

  • Sample

    210915-f4bcbscahj

  • MD5

    af0366a8e19aafc48efd00205417ad12

  • SHA1

    ef1feb2284ca17cf6fa64a54cdf11f6ecffdbf41

  • SHA256

    dcc3e9ff88844c90d49a10a3cc63bed8cb18ff4192a57cb1c7183022c47124e0

  • SHA512

    8dd877e853f12c425a8d86938e9205ff8607f71fee7f75a50a30418cc6f6e9b06760ecbd6b00d813ce38b4e9ca67074b0ff3a367629145492e70acf4681e1816

Score
10/10
pyinstallerransomwarespywarestealer

Malware Config

Extracted

Path

\??\c:\HELP - README TO UNLOCK FILES.txt

Ransom Note
Hi, all your files have been encrypted/locked with a Military grade encryption algorithm. There is no way to restore your data without a special key from me. Don't panic, you can still restore all your files in few minutes, you just have to pay me for the ransom. 1. You have to send payment of 0.03 BITCOIN to: bc1qgq8pawjsc5wa392wy92y5pvvskxljks0w6zfcd 2. Once payment have been completed, send proof of payment to: ransomnow@yandex.ru 3. Use your Computer name as email subject so that i can identify your private recovery key. You can buy bitcoin very easily from these sites: www.localbitcoins.com www.paxful.com A list of several sites where you can buy bitcoin can be found here: https://bitcoin.org/en/exchanges IMPORTANT WARNING!! Make sure payment is sent to: bc1qgq8pawjsc5wa392wy92y5pvvskxljks0w6zfcd Do NOT attempt to decrypt your files with any software because it will not work and you may corrupt your files. Do NOT change file names or mess with the files Do NOT send "PAID" message without paying, price WILL increase for disobedience. Do NOT think that we won't delete your files and throw away the restore key when you refuse to pay, WE WILL!!!
Emails

ransomnow@yandex.ru

Wallets

bc1qgq8pawjsc5wa392wy92y5pvvskxljks0w6zfcd

Targets

    • Target

      af0366a8e19aafc48efd00205417ad12

    • Size

      6.8MB

    • MD5

      af0366a8e19aafc48efd00205417ad12

    • SHA1

      ef1feb2284ca17cf6fa64a54cdf11f6ecffdbf41

    • SHA256

      dcc3e9ff88844c90d49a10a3cc63bed8cb18ff4192a57cb1c7183022c47124e0

    • SHA512

      8dd877e853f12c425a8d86938e9205ff8607f71fee7f75a50a30418cc6f6e9b06760ecbd6b00d813ce38b4e9ca67074b0ff3a367629145492e70acf4681e1816

    Score
    10/10
    ransomwarespywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks