General
-
Target
9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c
-
Size
73KB
-
Sample
220128-dvn6qaehbq
-
MD5
1c021f42e3a138060e1d298726d1579f
-
SHA1
54e3384fb68fde6fc711491e8072781e3910156a
-
SHA256
9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c
-
SHA512
5ee344d17b5e9a2285258b8e16253263ebb856167b36e7679e602c041c2320c10a7182a7cb5c14f59fe3117a981e96fdff6fa7dc2c2194e90a6f659de143c101
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\How_to_recovery.txt
Ransom Note
68F56EA7B89D377BC3CFC8B3E865CD03B5FD291B8612BE9FE5923B3CA7445ADE
5B25EE6A5B1485570D4927CFB1F4A46740F419AD4F3DFAC6E3E1E1FC0569EA5E
3CC57B68D428DA3A712280E2EC4B5C606BB354D37EA31C4C95CBCB2978D48AB7
D89ED5DC8FF29441E582EB33B16B9A83C507D80C8802EDC4D9ED7C4E07C4F92A
019A0217C3AB0B0D6BF5B7EAEECD6EA9D9E948F211074B5F8A8B0D7A214FD35C
77BB10F3488AD8775348CA2C7DFE6F00846694576D08CB46B91F2503AFF3A305
BC37F115C70933318E442E0BC6AC6D9D05B5C8B480396939FC06144DC4907F8D
1332B3EFCAF67A2FFC2D7524AB17B25815F6D656F77E29DDB55D0E80EA745277
1D58CAB8146D3FC268252615E7AEC5E4FDA01737184060D0B52ADC30224887B4
9FAE947D64127CCF525E79F8830B8D7B723F8B4C21E48FDA47A1E9623DA2673F
1C50C5B1B9CFB047FE1E24C996F2AC5E31B69CA65B6EC0711492DAC29BBF5D61
E3A9FAA3CEEEB3750C1936FA3014C7B8DCB7F3F48AAC3DD2D113CD9D640D3093
04026203440DE1528114B5EAEB7F78471041528335EAEAA491CF93DE6CA6C15A
9F4215F07340A4251ACC43E527682D88CF37F91852868ED47400D793BBDA49E3
08C051E6E78DF07F07BEA00EDC23C837C1735E1962B7810A6A453C3905672FDD
5CF235459A815D0608211A845F45A498B170CFBEFE1E19415E7F8F131BF23099
109E6661ADF74F4877F057202C6261B24CD55E044A6B5E0DB2C0005C130764C6
105220441E61E5A857E54306024B7DD6AACF83E5D4CB26FB621F283AF0C5E10C
F47138A34D730D4690D78AEA4575D7497CB0C28B54DCC6465146650A7933EBCB
0AE9E973C8C1EC57B226B33AFF723AA38FB15CD8CE72993CCD5D874888BEABCA
DF4503A01F7803063E0B61DD929445D246A7D5CDD7C33A0F3ECDC191E07AF591
443AADD81C854D55007D1E1409A1C137AE5F578395F11A5582A1058120DBD5AD
5AF711F0268DFE351CA84AE00E06F988FD07FB9197B06FD51469AF551E32F025
E73CD34C1CBCEB083F9CC2D8A317323F8C5AB3CAC472B96BB66E6D8D09248DAB
A5124595D545F553656B8AC9889EE252B4ED6D63F42B780D2CED54B1819B2B19
A550950175FC8B00E5
Contact us for price and get decryption software.
Note that this server is available via Tor browser only Follow the instructions to open the link:
qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.
3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
4. Start a chat and follow the further instructions.
If you can not use the above link, use the email:
[email protected]
[email protected]
* To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
���������������
URLs
http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
Extracted
Path
C:\odt\How_to_recovery.txt
Ransom Note
F5721E1E5D0B5A60998168818C573450D28684A7CC0E357AC5FEAE6DDF4AD54D
3055C38B717593BF62BC17B4C353AAC119047C989B5395EEDFF838482715B665
3415C4B517FE72C0D8A29074F670655D9E8A99534632515D5059F066C6D7D9B4
72C83493CE02A5A1013FAB5A0C8E71705EE05FF91BE2D8C63DCA7CF23F8B7F88
DFB579467D960A9458134C9871EB328F54D93397857CA3517E2503D307E98C4D
9431EE5883CC3ABA12C676B558B517C332A3F2A16BC8CE736152E597EC4EA6EA
85F23D6F47E43761B33072C07258025650F596E221423F89A6CA19F556F1B172
F7FD2DFDBD697DC03242B2A4C7ACEF9BEDB336324086B72ABC299E89E39828E7
0CE2CD7E6D9900C0F96DE824EEDB0D12B2999813991DD15E03275DD0070F3810
6B5D0B0E5E6910E6B851FDF69AF50E233276FF3487B2A96CEEC3C11DC44A0454
6EE82BE48679C136B82DC21C50FBD5F3DC5E5F585CA5DBE783D8798E0697DC1D
41D8E369496110B1F7F982724C14B82C41626F2F63C1A4144D86688FB46EA25C
D87E0B936A7B93E324BE74470BCCED6EB7B631F503A2776F09841B85573FFD3A
A9D978B8CCCC3FA24B545CF91C4CD0E4F12E9B2B5ED57E5274BBEF6F8EB792FB
150AE3EBB31B154C2FC0708089DB69DA979AFFE7F3AAF649AEA7DC2B87726DB0
9F402A0F53EDFE8EE00CB80DC8FDB96898F3303092DAF69CC347A63C9AAB26B6
939EEE725164548C7A18C8F0CEFE24C35CEAD344D700AF467FBD50BBB3304924
03F5E54DB7B652E350E5E512A1C1D97984E326F3A2A1B42EE2C0CB5A04C03E0D
00B62F8F3842E935FA7703AC9ACAC10B3D750158018D08E8FB6C7F2D93A087BC
EAB387099C9A62A351304341182AD077C8222E7FDB4CD18FA492BE8E73F77310
330B18B7F930656EBBB779DD8021AA5CE3BECC753648EA7EE8BEFC66CCC2ED3D
43CAD24B9664D5452B1A9E3FFEDA4F2320870C1E118BD19CD8C0063ACDB0EB33
D91D638BF93127E9E541E9CA366A40A87277F905BD47A4C30428294F32871645
C48DEAD7D94051EE9C3C8948E45675D31A3E4D9A6F4EDBFE0976B01348EBC16B
E1C24D006574C3881E8D4D094E76B1056A8470FABA90AF89871E54D5D8E28C62
92318AD6F1841801C9
Contact us for price and get decryption software.
Note that this server is available via Tor browser only Follow the instructions to open the link:
qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.
3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
4. Start a chat and follow the further instructions.
If you can not use the above link, use the email:
[email protected]
[email protected]
* To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
���������������
URLs
http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
Targets
-
-
Target
9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c
-
Size
73KB
-
MD5
1c021f42e3a138060e1d298726d1579f
-
SHA1
54e3384fb68fde6fc711491e8072781e3910156a
-
SHA256
9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c
-
SHA512
5ee344d17b5e9a2285258b8e16253263ebb856167b36e7679e602c041c2320c10a7182a7cb5c14f59fe3117a981e96fdff6fa7dc2c2194e90a6f659de143c101
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-