General
- Target kings.exe
- Size 72KB
- Sample220126-2aezbabbfq
- SHA256 36e4a3de5c4395d295bdf1d70a215d9669b626c58083ec2d8ab29513830faaa6
Score
10/10
Malware Config
Extracted
Path
-
C:\RestoreFiles.txt
Ransom Note
- Hello, friends! Your system has been compromised by our team.We have blocked your files and also uploaded useful data from your computers(doc, docx, pdf, xls and other office extensions) to our servers. You have 2 days to contact us to discuss the terms of payment for our services to restore your files.If you do not contact us or refuse to pay, we will place your stolen files in the public domain. Do not change the file namesand extensions.Do not try to decrypt the files yourself, they are encrypted using a good encryption algorithm. Main Mail: [email protected] Backup mail(if we don't reply 24 hours): [email protected] At the first contact, you can write to both emails for reliability.
Targets
-
- Target kings.exe
- Size 72KB
- SHA256 36e4a3de5c4395d295bdf1d70a215d9669b626c58083ec2d8ab29513830faaa6
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.