General

  • Target

    e_win.exe

  • Size

    664KB

  • Sample

    211116-t91fasbffl

  • MD5

    2c1bacb056654515171bedadaecfe67e

  • SHA1

    d45f9fccbb7c4c1221e3eb4d7801fa0a5910012e

  • SHA256

    d81f751a2b47e3195fb035c804fc7a54d1c51426f759c53048bd9837663a101a

  • SHA512

    79977a9fd287bc32072e74a45cc81e96351b6805e65c700df1be5e1e64a3c3f1db36830544418490896f88e630748d14c88bf86321a0f88ca50b3dffab57830a

Score
10/10

Malware Config

Extracted

Path

C:\Guide To Recover Your Files.txt

Ransom Note
!!! YOUR NETWORK ENCRYPTED !!! What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data. What guarantees? ---------------------------------------------- We guarantee that you can recover all your files safely and easily. You can decrypt a single file for warranty - we can do it. Find a *.chichi file on your computer and upload and get the original. (maximum file size - 512Kb) Chat with support But if you want to decrypt all your files, you need to pay. Write to support if you want to buy decryptor. How to contact us? ---------------------------------------------- Write to email : semenov.akkim@protonmail.com, chichihao@protonmail.com, velbms@rediffmail.com, sonuamit555@rediffmail.com, smenov@bitmessage.de How to Pay? ---------------------------------------------- You need pay $300,000 Payment has to be deposited in Bitcoin based on the Bitcoin/USD exchange rate at the moment of payment. The address you have to make payment is: bc1q0lasrt2qjgantwy0ylzrdttlmmz6ap09l8964g Attention! ---------------------------------------------- Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. You have to deposit payment within 72 hours (3 days) after receiving this message, otherwise, you will lose your files forever and we will start posting your data to the dark web.
Emails

semenov.akkim@protonmail.com

chichihao@protonmail.com

velbms@rediffmail.com

sonuamit555@rediffmail.com

smenov@bitmessage.de

Targets

    • Target

      e_win.exe

    • Size

      664KB

    • MD5

      2c1bacb056654515171bedadaecfe67e

    • SHA1

      d45f9fccbb7c4c1221e3eb4d7801fa0a5910012e

    • SHA256

      d81f751a2b47e3195fb035c804fc7a54d1c51426f759c53048bd9837663a101a

    • SHA512

      79977a9fd287bc32072e74a45cc81e96351b6805e65c700df1be5e1e64a3c3f1db36830544418490896f88e630748d14c88bf86321a0f88ca50b3dffab57830a

    Score
    10/10
    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.