Overview

overview

10

Static

static

8

853f52243f...a6.exe

windows7_x64

10

853f52243f...a6.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6
  • Size 233KB
  • Sample220201-s2tr4shbf2
  • SHA256 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6
  • MD5 SHA1 SHA512
Score
10/10
akopersistenceransomwareupx

Malware Config

Extracted

Path

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ako-readme.txt

  • ako

Ransom Note
  • Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .c0A6vQ Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuYzBBNnZRIiwgImtleSI6ImF6R2VzWXROWXpOWDFTOVBpZm5icG1 wRWNBTnZzQ2RuZjErTmNpa2p2cWVIcXRTTkp4b1hnZktCbTJJb2l3TEF3M21uQ 0FJVTlkb2s0eEZLZEh4WGFMSEdZNCtvd0syTkxuZy9Hc3Y1aXhYYzAvL0QvWWF YMzYvWk11MmEvTXd4SkxHaTFOcVQrcmtoMEZiVDZWL0kyLzVIWWFRTWE0NU9ma 1dNazhJV2prN3d5dFg3bFNEZG5LbTVRKzNvbHpOSHgwVUprS0krSVVNRmlNNC8 xRjF3ZFpKZm9xVXhUR2JWU2E0MVJTQm9IWUJuckNFZ2ZGT09HMDFJZzhDdm16Z XFZL1BYeG9KMUZyMlVmb1BDMUh1cDQ0MTU4aTVaWWMvc1IzRndMVjlQaVorOC9 IVnBTUVNoV21aMlBncWdqVDZYc1hzbU5BRDQzdTRsd09YRXRTTmVnUT09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---
URLs

  • http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN

Extracted

Path

  • C:\ako-readme.txt

  • ako

Ransom Note
  • Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .l0h2oh Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIubDBoMm9oIiwgImtleSI6IlB1RE9LTzZQejhWVHFhVFBCY1hBQm5 YT3d6VUZXcjFoeVJ1WjNHVmYxaTBKVWsyOVFXTjlrZmhoTi8rbjFyZzFOcE9JZ FNlaFpnWWNsbSs3ODdZY2J0UENOS2N6TVdRMXkzZEtsVUYwTFRSR2ZzOFNlaGZ xZ0pqNURRMWsxR0lsZ0JtRW1qNnk3Z2pGRytWb0NpR1dEQU45WEtqRWR3ZEE2b EFlbXIvVlViRzhINjdKTE5lUUhnM0lBem8rUDZveVI0NUNYekJUZlFPNmZLQXg 0Ulh6dm9sQUtnUEVPUVhPV3B1b3RPcVVCV2hkZEMxaEpKbkdHN2NhZCtqYXFLY XNlRGhwV1k4U1lpRm5zelptTjAvTVVPTHp5dzJwUVgreVFYN3ZPYU9HWFNraVM 3SjZ0ei9zYzNMU3hvbTh6anZCUkRrN1FldUFSL25PVEZHUDN2cE91dz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---
URLs

  • http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN

Targets

    • Target
      853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6
    • Size 233KB
    • SHA256 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6
    • MD5 SHA1 SHA512
    Score
    10/10
    akoransomwarepersistence

    • Ako

      Ransomware strain discovered in early 2020.

      ransomwareako

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Sets service image path in registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks