Overview

overview

10

Static

static

d3f80ebec4...76.exe

windows7_x64

10

d3f80ebec4...76.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3f80ebec40d7c729b87c19bd8f1760a8ec88228839e7d408d571b1577b2b776

  • Size

    15KB

  • Sample

    220204-qlstrsadc4

  • MD5

    ae3aab90f69a05b131bd76abe8a5a988

  • SHA1

    e4b09d053f6d0d95a318a552fc69291874a166c9

  • SHA256

    d3f80ebec40d7c729b87c19bd8f1760a8ec88228839e7d408d571b1577b2b776

  • SHA512

    2c411bf12e79e8620c1188147d6d5d0b06877ad5c60b1043e0d13a8e508dfcf85e95f3691fcd12081d60db42bc3bcf8ef00837318559fe6aac3da34e406ec714

Score
10/10
prolockransomware

Malware Config

Extracted

Path

C:\[HOW TO RECOVER FILES].TXT

Family

prolock

Ransom Note
Your files have been encrypted by ProLock Ransomware using RSA-2048 algorithm. [.:Nothing personal just business:.] No one can help you to restore files without our special decryption tool. To get your files back you have to pay the decryption fee in BTC. The final price depends on how fast you write to us. 1. Download TOR browser: https://www.torproject.org/ 2. Install the TOR Browser. 3. Open the TOR Browser. 4. Open our website in the TOR browser: qyyllfooubxzl5am25xoessrbnluxpj73ylgtlx25xdg74yuheaigfqd.onion 5. Login using your ID MCC1D3C303AEA0018852 ***If you have any problems connecting or using TOR network: contact our support by email chec1kyourf1les@protonmail.com. [You'll receive instructions and price inside] The decryption keys will be stored for 1 month. We also have gathered your sensitive data. We would share it in case you refuse to pay. Decryption using third party software is impossible. Attempts to self-decrypting files will result in the loss of your data.
Emails

chec1kyourf1les@protonmail.com.

URLs

http://qyyllfooubxzl5am25xoessrbnluxpj73ylgtlx25xdg74yuheaigfqd.onion

Targets

    • Target

      d3f80ebec40d7c729b87c19bd8f1760a8ec88228839e7d408d571b1577b2b776

    • Size

      15KB

    • MD5

      ae3aab90f69a05b131bd76abe8a5a988

    • SHA1

      e4b09d053f6d0d95a318a552fc69291874a166c9

    • SHA256

      d3f80ebec40d7c729b87c19bd8f1760a8ec88228839e7d408d571b1577b2b776

    • SHA512

      2c411bf12e79e8620c1188147d6d5d0b06877ad5c60b1043e0d13a8e508dfcf85e95f3691fcd12081d60db42bc3bcf8ef00837318559fe6aac3da34e406ec714

    Score
    10/10
    prolockransomware

    • ProLock Ransomware

      Rebranded update of PwndLocker first seen in March 2020.

      ransomwareprolock

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks