148845af1fc1221f27992cac24273aada38ef2482624850897bce87413f79888

General

Target
xxx.exe
Size 2.5MB
Sample211027-jaa19aahb7
SHA256 148845af1fc1221f27992cac24273aada38ef2482624850897bce87413f79888
MD5 e358685d7f843a7c91a6ba328f4d900c
SHA1 05aaba7ad51b253861714ff74a665461606e14ab
SHA512 69f5dc5bd415e69554a274fbda8fed69d79e216496f7907436161537c5a52ca2e299a381a13bf5fc1948b121c23866e66c5a244a066cb46d98e4e3a97f8a6b1e
MD5 SHA1 SHA512

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\PUSSY!!!DANGER.txt

Ransom Note

Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: [email protected] [email protected] [email protected]

Emails

URLs

http://corpleaks.net
http://hxt254aygrsziejn.onion

Signatures

Drops desktop.ini file(s) 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	xxx.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2481030822-2828258191-1606198294-1000\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	xxx.exe

C:\Users\Admin\AppData\Local\Temp\xxx.exe
"C:\Users\Admin\AppData\Local\Temp\xxx.exe"
1⤵
- Drops desktop.ini file(s)
PID:3812

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads