903c04976fa6e6721c596354f383a4d4272c6730b29eee00b0ec599265963e74

General

Target
xd.exe
Size 42KB
Sample211202-mj8knahhd2
SHA256 903c04976fa6e6721c596354f383a4d4272c6730b29eee00b0ec599265963e74
MD5 a034f79273e3f61d34eeadf38f12dee2
SHA1 9c8feeab65f71344713d63f4879e247aba49dce4
SHA512 f88ae1a3fdc901e49c3ddae6008f80c3b647f2fb88d32c9d726d91f52f65d5af5b2c6c0bdc9dba556f797e9c9075befb4d639a1b6ff990b060bdb081f2945caf
MD5 SHA1 SHA512

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\PerfLogs\Hello.txt

Ransom Note

.;tLG008000000GLt:. .1G80Lt;:.. .,:itC08Ci ,f80t: :f88t. 1@0i 188i .C@t .L@f C@i t@f t@t ..,,:::. .:::,,.. C@i .88..CGG000000G8@; 1@0G000000GGL :@G :@G 0@1.... G@: i@L ....f@L .8@. :@C ,G8t:..,i0@1 f@Gi,..:f@C. 0@. :@C iC0000Gf, :fG0000C; 0@. :@C .. :i111;, ... 0@. :@C :L80GCLCG00f, 0@. ,tCGGCt,,@C f@G;. .i0@t 0@,iLGGGLi t@01;;1G@0@C f@t L@1 0@88f;;if@G, :@G ,f0@f, 8@. ,@G iG@Ci ;@L .0@; .iG@f .8@0000000000000@G :08L: .L@1 ,L@G1. :: ,,,,,,,,,,,,,,,,. .:. :L80i ,f88f, iG@C; iG@G; ,f88f, :L801. ;L80i. ;@@8f :08@@. :@C:: .;.0@. ░█──░█ █──█ █▀▀█ ▀▀█▀▀ 　 ░█─░█ █▀▀█ █▀▀█ █▀▀█ █▀▀ █▀▀▄ ▀█ ░█░█░█ █▀▀█ █▄▄█ ──█── 　 ░█▀▀█ █▄▄█ █──█ █──█ █▀▀ █──█ █▀ ░█▄▀▄█ ▀──▀ ▀──▀ ──▀── 　 ░█─░█ ▀──▀ █▀▀▀ █▀▀▀ ▀▀▀ ▀──▀ ▄─ Not so long ago, we discovered a serious problem with your network and decided to help you. So what happened? All files are encrypted with Integrated Encryption Scheme. The file structure was not damaged. You have been assigned a unique identifier. After infection, you have 96 hours to declare decryption. After the expiration of 96 hours, decryption cost will be automatically increased. █░█ █▀▀ █░░ █░░ █▀█ ▀▄▀ █▀▄ Now you should send us █▀█ ██▄ █▄▄ █▄▄ █▄█ █░█ █▄▀ message with your personal identifier, which is at the bottom of the message. We hope that you understand the importance of the work we have done, if the vulnerability were found by someone else, it is possible that the consequences of the attack could be much more sensitive than the usual payment of money due to us for work. Free decryption as guarantee! Before paying you can send us 2 files for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). ▄▀█ ▀█▀ ▀█▀ █▀▀ █▄░█ ▀█▀ █ █▀█ █▄░█ █ DO!! NOT!! TRY!!! █▀█ ░█░ ░█░ ██▄ █░▀█ ░█░ █ █▄█ █░▀█ ▄ TO!! CHANGE!! or apply any other influence encrypted files by yourself!!! If you willtry to use any third party software for restoring your data or antivirus solutions - this can lead to complete damage to all files and their irrecoverable loss, since it will no longer be possible to restore them Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. ...!XD :: your personal id: 9889E042B07F83DA :: our TOX below >:) A746E398A5BC9AD9F281F5D10CF861546092D0F2107F12EA9F107EFB7D21CA41F312B73FB114 You can download TOX here: https://tox.chat/download.html

URLs

https://tox.chat/download.html

Targets

- Target
  xd.exe
- Size 42KB
- SHA256 903c04976fa6e6721c596354f383a4d4272c6730b29eee00b0ec599265963e74
- MD5 a034f79273e3f61d34eeadf38f12dee2
- SHA1 9c8feeab65f71344713d63f4879e247aba49dce4
- SHA512 f88ae1a3fdc901e49c3ddae6008f80c3b647f2fb88d32c9d726d91f52f65d5af5b2c6c0bdc9dba556f797e9c9075befb4d639a1b6ff990b060bdb081f2945caf
- MD5 SHA1 SHA512
Score

10^/10

ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Drops startup file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2