General
- Target e_win.exe
- Size 664KB
- Sample211116-t91fasbffl
- SHA256 d81f751a2b47e3195fb035c804fc7a54d1c51426f759c53048bd9837663a101a
Score
10/10
Malware Config
Extracted
Path
-
C:\Guide To Recover Your Files.txt
Ransom Note
- !!! YOUR NETWORK ENCRYPTED !!! What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data. What guarantees? ---------------------------------------------- We guarantee that you can recover all your files safely and easily. You can decrypt a single file for warranty - we can do it. Find a *.chichi file on your computer and upload and get the original. (maximum file size - 512Kb) Chat with support But if you want to decrypt all your files, you need to pay. Write to support if you want to buy decryptor. How to contact us? ---------------------------------------------- Write to email : [email protected], [email protected], [email protected], [email protected], [email protected] How to Pay? ---------------------------------------------- You need pay $300,000 Payment has to be deposited in Bitcoin based on the Bitcoin/USD exchange rate at the moment of payment. The address you have to make payment is: bc1q0lasrt2qjgantwy0ylzrdttlmmz6ap09l8964g Attention! ---------------------------------------------- Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. You have to deposit payment within 72 hours (3 days) after receiving this message, otherwise, you will lose your files forever and we will start posting your data to the dark web.
Targets
-
- Target e_win.exe
- Size 664KB
- SHA256 d81f751a2b47e3195fb035c804fc7a54d1c51426f759c53048bd9837663a101a
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.