General
- Target hptestu.exe
- Size 662KB
- Sample211012-qh43macchk
- SHA256 2c895d282fa795252bb859323040e62af0087e626244a9768eca8089ce25291f
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\README_encrypted.txt
Ransom Note
- ATTENTION!!! ALL YOUR FILES HAVE BEEN ENCRYPTED YOU WILL HAVE TO PAY 1 Monero (https://www.getmonero.org/get-started/what-is-monero/) TO UNLOCK YOUR FILES. PLEASE GO TO http://t2tqvp4pctcr7vxhgz5yd5x4ino5tw7jzs3whbntxirhp32djhi7q3id.onion/register IN TOR BROWSER (https://torproject.org/download/) AND NOTE DOWN YOUR REDEEM ID AND PAYMENT ADDRESS. AFTER THEN TRANSFER 1 Monero TO THE PAYMENT ADDRESS (https://www.getmonero.org/resources/user-guides/make-payment.html). GO TO THE PAGE AGAIN AND CLICK THE "To redeem a payment, click here" LINK AND TYPE YOUR REDEEM ID THEN CLICK "Check payment". AFTER THEN AT THE UPLOAD PAGE SELECT THE metadata.bin FILE IN YOUR USER FOLDER AND CLICK "Get decryption keys" AND DOWNLOAD YOU DECRYPTION KEYS. PLEASE DO NOT ATTEMPT TO USE THIRD-PARTY DECRYPTION SERVICES. THIS WILL RESULT IN YOUR FILES PERMANENTLY LOCKED. THIS SOFTWARE USES STATE-OF-THE-ART ENCRYPTION ALGORITHMS USING X25519 AND ChaCha20 ENCRYPTION ALGORITHMS. ONLY OUR DECRYPTION SERVICE CAN UNLOCK YOUR FILES.
URLs
-
https://www.getmonero.org/get-started/what-is-monero/
-
http://t2tqvp4pctcr7vxhgz5yd5x4ino5tw7jzs3whbntxirhp32djhi7q3id.onion/register
-
https://www.getmonero.org/resources/user-guides/make-payment.html
Targets
-
- Target hptestu.exe
- Size 662KB
- SHA256 2c895d282fa795252bb859323040e62af0087e626244a9768eca8089ce25291f
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.