thanos | c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c

General

Target

c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c
Size

203KB
Sample

211029-s9dqvsacel
MD5

cefd366a2c000d9bbbd35dfd0a73311d
SHA1

0864171c1e033067b04317979803d97f1c90c85b
SHA256

c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c
SHA512

5f43b27b0495afb6ded495816405efe4a0d77b9991f56b7bfd09cd56d3ae890ec8dc2461a1806b2131edeaafc15d3478b471d1ef0376f9f78128eff539451040

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\HOW_TO_RECOVER_MY_FILES.txt

Ransom Note

ALL YOUR FILES HAS BEEN ENCRYPTED! ALL YOUR FILES HAVE NOW THE .LOCKED EXTENSION! TO DE-CRYPT YOUR FILES, CONTACT US HERE: 1- Download qTox >>> https://tox.chat/download.html 2- Install qTox and make a profile, after you have done this: 3- Use this TOX-ID (Copy + Paste): FF45ED6FCE4433D273E34DA1C22AC1B0290973082BE068066D5EDF6C62EF39500A691BDE33B9 and make a friend request, after 5 minutes, you will be in contact with our negotiator. If you want proof, attach 2-3 encrypted files together with the Key ID (you can find the Key-ID in the How-To-Recover-My-Files document on your Desktop,) less then 5Mb each, non-archived and your files should not contain valuable information, like Databases, back-ups, large excel sheets, etc. You will receive decrypted samples and our conditions how to get the decoder. Please don't forget to write the name of your company in the subject of your e-mail! Alternatively, please get in touch with the negotiator at the following email address: [email protected] Key Identifier: LjqyEfdX+jDDhC1aV62UQ5a6cCb1cZuUgN8e29VcKpyy9AL/OMcz9OSgswuWxkJPfxKIqqDjfCJeGm4LD3BIX+cUVdAd4+f5mc0KOoWxSTmJ4psJ5uPUqOdPXo5SkWzQBDxR4QVZ0JDdlGj974yH5UpDQAuU6f8RQ39IBFe2sUzhywIPEQE6EKUEXiNVjKKkZ0d4oeAxDTj6xbVJZEHqM+hxA40Smdr7J/Io3AqlLesGRXDR2fL9SXblR5FoQpWQRDKTjWgDOG4/U4XsCHPX7nvkeXMEPdZJhGV+HGMRLPBhy+uqoYMZQLn7lksgm4Yln/FhJ5LobgEQXZoAt3Du6QizlzPbtiqCDtfbaZ3AfBoo9B4g98N/XO5QsfRiZo7sWD4kQGJGTtUPFRNTJTOddS32u6jAFO/ZhoVrgs+wKBnQql0qaCH3rn/WxKiiXBMvzT69/BUIiiMkonv0qDlZEcbajIhoKTOxJLyVrUPOfzU6aSfbCgZhsd/s5AKFegirzC1wm6E14uh5U6300Wpex81/g+UdGgCyVU19Y/6+ADFLq3idJlZM2X+Sw6gu8i2xgKmRomRrvCIcd0bSx4H/fpy3dXycVxS/TUhniWiaoKboyIl20t1LfWN+JiDz2JB1hn9rpe/ISEu07WLjoxaQjh98aqnEBvRLsJ+o0EOJOpE=

Emails

[email protected]

URLs

https://tox.chat/download.html

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\HOW_TO_RECOVER_MY_FILES.txt

Ransom Note

ALL YOUR FILES HAS BEEN ENCRYPTED! ALL YOUR FILES HAVE NOW THE .LOCKED EXTENSION! TO DE-CRYPT YOUR FILES, CONTACT US HERE: 1- Download qTox >>> https://tox.chat/download.html 2- Install qTox and make a profile, after you have done this: 3- Use this TOX-ID (Copy + Paste): FF45ED6FCE4433D273E34DA1C22AC1B0290973082BE068066D5EDF6C62EF39500A691BDE33B9 and make a friend request, after 5 minutes, you will be in contact with our negotiator. If you want proof, attach 2-3 encrypted files together with the Key ID (you can find the Key-ID in the How-To-Recover-My-Files document on your Desktop,) less then 5Mb each, non-archived and your files should not contain valuable information, like Databases, back-ups, large excel sheets, etc. You will receive decrypted samples and our conditions how to get the decoder. Please don't forget to write the name of your company in the subject of your e-mail! Alternatively, please get in touch with the negotiator at the following email address: [email protected] Key Identifier: lDTO1SAbz9qtw2XFBP12DyqdWP+Tor27gNFwYyAKvoQR/JQjh+ApS27DHMh6Kde5APF+wrIPKG8q08W08qCGtU8SQKUi9YEtgfWsa1YXSWcdLNqpAjYwSY9AI/KtEBHQ7moltUfF4rPSOB3SzqlvAe6ttH0h9bWuJBVTGP+TrW6H04YY7JWWxgaf27+hDYfIhFCI+r4NwqZeSDNPLqM5xTBRLV4pI7p7d8Ie4LqvCg18erTCzG1fWlV5gsbhUo2frbZCPRa5S+uNamY4rMf7eEQUzvcaVi7aBY2igT7yXdsA5oOQFcGA1uX0QpZ75cLH3lQNvIHJBf9MoEw+Xyvn4Ju5LjZPor2dy1KOLYxuEGKdiISkLyml5/Dhh7jVr8zgi0QL8tNBeb+STFoEtbI9CVYw252NsZ4UC3hTkX8JtF2fn7Mb0kWYYaXS/xk0Hsack7Fv28y36YbisdfbKjRh0qmdnCuqFcBUTlrM/3YJ7qHVCrpTUILglqSnrsOxyjJe5jyWHan4M+4l4RNHoCkNAMKBi0MVNiNmWfllXDorPi2Y1fzy/LbryQYcMCiR+ZvD8AHIFsnfWsIZoSl1R4OfDcMuaFjAbHTO1pym6IZHzHEdYEEVD1zVFjdr/Ug5e1gBGXVYq5bMkQ/IS1MF5n9iMJPTHvGc4hg9DOGwUNXH9FY=

Emails

[email protected]

URLs

https://tox.chat/download.html

Targets

- Target
  
  c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c
- Size
  
  203KB
- MD5
  
  cefd366a2c000d9bbbd35dfd0a73311d
- SHA1
  
  0864171c1e033067b04317979803d97f1c90c85b
- SHA256
  
  c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c
- SHA512
  
  5f43b27b0495afb6ded495816405efe4a0d77b9991f56b7bfd09cd56d3ae890ec8dc2461a1806b2131edeaafc15d3478b471d1ef0376f9f78128eff539451040
Score

10^/10

evasion persistence ransomware
- Blocklisted process makes network request
- Downloads MZ/PE file
- Downloads PsExec from SysInternals website
  Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Drops startup file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
behavioral1 behavioral2