General
- Target Ransom.exe
- Size 127KB
- Sample220210-yal6vaagdn
- SHA256 3f843cbffeba010445dae2b171caaa99c6b56360de5407da71210d007fe26673
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\RECOVERY INFORMATION.txt
Ransom Note
- YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. CONTACT US: [email protected] YOUR PERSONAL ID: 6C1F23C5132C �
Emails
Extracted
Path
-
C:\Program Files\RECOVERY INFORMATION.txt
Ransom Note
- YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. CONTACT US: [email protected] YOUR PERSONAL ID: A3723262B8F2 �
Emails
Targets
-
- Target Ransom.exe
- Size 127KB
- SHA256 3f843cbffeba010445dae2b171caaa99c6b56360de5407da71210d007fe26673
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.