targetcompany

General

Target

af723e236d982ceb9ca63521b80d3bee487319655c30285a078e8b529431c46e
Size

129KB
Sample

220208-3dw8fagegl
MD5

2acb21c02b38dad982d78ebff7cfa2d3
SHA1

75543627f8f2ab0c85228372a0eca6928ee84b7d
SHA256

af723e236d982ceb9ca63521b80d3bee487319655c30285a078e8b529431c46e
SHA512

dfa53b2deff45b2b32cf8dcb346d42c8a5781e439103f5a4f537c78c681b865c8b71b804e8eedca70b1fe65582d0c40a0da3dc6a167c2a8396ec8f9080af28e2

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\How to decrypt files.txt

Family

targetcompany

Ransom Note

Your personal identifier: ARCHDMCXVB All files on Architekturburo Ingenieurburo Joachim Schmidt network have been encrypted due to insufficient security. The only way to quickly and reliably regain access to your files is to contact us. The price depends on how fast you write to us. In other cases, you risk losing your time and access to data. Usually time is much more valuable than money. In addition to encryption, we downloaded data from your network, which, if we do not negotiate, could fall into the hands of third parties and cause damage to your reputation. FAQ Q: How to contact us A: * Download Tor Browser - https://www.torproject.org/ * Open link in Tor Browser http://eghv5cpdsmuj5e6tpyjk5icgq642hqubildf6yrfnqlq3rmsqk2zanid.onion/contact * Follow the instructions on the website. Q: What guarantees? A: Before paying, we can decrypt several of your test files. Files should not contain valuable information. Q: Can I decrypt my data for free or through intermediaries? A: Use third party programs and intermediaries at your own risk. Third party software may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam. �

URLs

http://eghv5cpdsmuj5e6tpyjk5icgq642hqubildf6yrfnqlq3rmsqk2zanid.onion/contact

Targets

- Target
  
  af723e236d982ceb9ca63521b80d3bee487319655c30285a078e8b529431c46e
- Size
  
  129KB
- MD5
  
  2acb21c02b38dad982d78ebff7cfa2d3
- SHA1
  
  75543627f8f2ab0c85228372a0eca6928ee84b7d
- SHA256
  
  af723e236d982ceb9ca63521b80d3bee487319655c30285a078e8b529431c46e
- SHA512
  
  dfa53b2deff45b2b32cf8dcb346d42c8a5781e439103f5a4f537c78c681b865c8b71b804e8eedca70b1fe65582d0c40a0da3dc6a167c2a8396ec8f9080af28e2
Score

10^/10

targetcompany evasion ransomware
- TargetCompany
  Ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
  ransomware targetcompany
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2