Overview

overview

10

Static

static

8

9c2bab6fc9...91.exe

windows7_x64

10

9c2bab6fc9...91.exe

windows10-2004_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91

  • Size

    5.0MB

  • Sample

    220204-qmskdsadd4

  • MD5

    c182610dd437f90d0cc6cb0ac19cfdb7

  • SHA1

    9729820748673938e057ce74d007b758f6f9b195

  • SHA256

    9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91

  • SHA512

    618bb4559c36eec0b8e3552c16b94b0060d68186b9864ca6670d8a17225088a69a498a367a226f5944a3b7d79a61565cd7123e27001053000b6d42d86352051a

Score
10/10
prolockransomwarevmprotect

Malware Config

Extracted

Path

C:\[HOW TO RECOVER FILES].TXT

Family

prolock

Ransom Note
Your files have been encrypted by ProLock Ransomware using RSA-2048 algorithm. [.:Nothing personal just business:.] No one can help you to restore files without our special decryption tool. To get your files back you have to pay the decryption fee in BTC. The final price depends on how fast you write to us. 1. Download TOR browser: https://www.torproject.org/ 2. Install the TOR Browser. 3. Open the TOR Browser. 4. Open our website in the TOR browser: ug76vzhn2fujp6of2mjb6rjt4rploqe4q5gr2bkuaiwmzpf7nehzpsqd.onion 5. Login using your ID PPD8535CAAEC677E9FAF ***If you have any problems connecting or using TOR network: contact our support by email chec1kyourf1les@protonmail.com [You'll receive instructions and price inside] The decryption keys will be stored for 1 month. We also have gathered your sensitive data. We would share it in case you refuse to pay. Decryption using third party software is impossible. Attempts to self-decrypting files will result in the loss of your data.
Emails

chec1kyourf1les@protonmail.com

URLs

http://ug76vzhn2fujp6of2mjb6rjt4rploqe4q5gr2bkuaiwmzpf7nehzpsqd.onion

Targets

    • Target

      9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91

    • Size

      5.0MB

    • MD5

      c182610dd437f90d0cc6cb0ac19cfdb7

    • SHA1

      9729820748673938e057ce74d007b758f6f9b195

    • SHA256

      9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91

    • SHA512

      618bb4559c36eec0b8e3552c16b94b0060d68186b9864ca6670d8a17225088a69a498a367a226f5944a3b7d79a61565cd7123e27001053000b6d42d86352051a

    Score
    10/10
    prolockransomware

    • ProLock Ransomware

      Rebranded update of PwndLocker first seen in March 2020.

      ransomwareprolock

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks