ako

General

Target
31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c
Size 592KB
Sample220201-s8stdshaaj
SHA256 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c
MD5 0febdea9572d614806a0400344694036
SHA1 f8183db409a49712d8bc4b0200c187e0531d2b76
SHA512 6573b7d6798a70d057c47bed1631ab9e95950cc36a4df72ce80c9956d590e4e9042ab1ca92bbf66beb16fffaefb95b3dc8f648f904d7049ade1fbf51440ffad1
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ako-readme.txt

ako

Ransom Note

Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .23Hkdi Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/40JRLFEREJ4HO8BG 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuMjNIa2RpIiwgImtleSI6IjZRWUFKQURHcmR6ZEoyRkF4clVQMk9 mMTE0NFI4OHdwa3hUdlhlUFIxdHVUcUU3NXllaE9GSCtQUGZkTXM1MG1nMThFa mFsNVd3M282L2M2VlIya2xtVkJqT2taQzlicFRpd3p4YkhDTDZHTm1vekpSWGJ uckpwNUdnbW5nYTZxV0plaWxleHR2MFZXaWxDVXc5NWR4R2lOQnlFQmdKc1pUM 0VTUlNscDBOa3EzcmtMUDQvdnJGakQzc0pNRGRSWGEwTjJvVEd1eXd4Um9CV2R WY2Q5UFBxRDJXeTVOaGZTU0NuVGNHTG9USUkvSUtCeFhWUUVmTzcvMmo5ZllRW UVpamUzS0VmN2N4cHBUb1oxcEppTXcyZ0c1TjFCL09MSU9JTTNPOVA3OWhjZUY 1Wkl2eURqVkMzS0JTODFjYlZsTkloN2NGUi82OEZvUEhlVHV5T1RKdz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---

URLs

http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/40JRLFEREJ4HO8BG

Extracted

Path

C:\ako-readme.txt

ako

Ransom Note

Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .gZim20 Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/40JRLFEREJ4HO8BG 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuZ1ppbTIwIiwgImtleSI6Im1tdlB5SklBUWgyandZTk9pbzFEUEc 2VG9QejUrblcrVGhnLzNDdjFQR1FGbWQxeklITENMUG8zNEFkMXVHcDNmZUdUb 1ZRbi9iNlY0bXBpY3dTVmE2Q3N3MGZyUlJTYVB5eitnL2craTB5R1hPdUV6YUR 4RDJJUkFsckkyQlJHRjNyWXFscDFyOW95cWtGSEpZT3J6d3ZxcEZ6Q0ZkSTJaY kp4SnFGUGQvSHpEUnhFVXU0ajdEK0VMdWczVE1XMmJYbGtiMnd2cjFzck5BOG9 WMDZzSXFwV0l5VmttMEVndjJjMlQzdnVYRW9VQkFaOXp0eHIvaFJycEpBa1BjN WhNUUhYb1FmOGlrZ2MxYmo3Sm8yOGtpWDRsMExPNmNEaExUbHBQcVFZQ1J0ZlZ 0UlZHblU2TFZxUDJocWJwV1doK2FhREpyc1BOWnhpS0pqNDFwb1Rzdz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---

URLs

http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/40JRLFEREJ4HO8BG

Targets

- Target
  31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c
- Size 592KB
- SHA256 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c
- MD5 0febdea9572d614806a0400344694036
- SHA1 f8183db409a49712d8bc4b0200c187e0531d2b76
- SHA512 6573b7d6798a70d057c47bed1631ab9e95950cc36a4df72ce80c9956d590e4e9042ab1ca92bbf66beb16fffaefb95b3dc8f648f904d7049ade1fbf51440ffad1
- MD5 SHA1 SHA512
Score

10^/10

ako ransomware persistence
- Ako
  Ransomware strain discovered in early 2020.
  ransomware ako
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Sets service image path in registry
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2