General
- Target TimeTime.exe
- Size 19KB
- Sample211219-b3r68sgfdp
- SHA256 5ee8500fe1a2f22029908d4e2b32e7fb85aec03ffea714f3b5e82ebb2bc10f21
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\@[email protected]
Ransom Note
- ---------------Time Time Ransomware--------------- All of your document,pictures,videos are no longer accessible. We encrypted them ! We also stole your files,computer information,passwords,cookies. If you don't pay us, we will leak everything on the dark web. Please, find @[email protected] on your desktop to pay the ransom. If you don't find it, check your recycle bin or antivirus quarantine. We ask for 100€ of paysafecard (https://paysafecard.com) /!\ Warning /!\ Please, do not rename encrypted files. Do not use third party software. Do not try to decrypt the files yourself. /!\ Warning /!\ You got epicly pwned. ---------------Time Time Ransomware---------------
URLs
-
https://paysafecard.com
Targets
-
- Target TimeTime.exe
- Size 19KB
- SHA256 5ee8500fe1a2f22029908d4e2b32e7fb85aec03ffea714f3b5e82ebb2bc10f21
Score10/10-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Drops file in System32 directory