General
-
Target
53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718
-
Size
105KB
-
Sample
220211-hqj4esdgam
-
MD5
467cceb1ab90bf50dc35f65dc513a483
-
SHA1
907c7792120b5aee6970b4b13747a729fbd59f7d
-
SHA256
53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718
-
SHA512
e85f314c33cb521ea3dabec4b2fcfde61a5bab2e5b06a2eb0268f0c35c510318a6510dd77bc2bfa11b7350533adf659895a440ee1496d335843dfad712121f1c
Score
10/10
Malware Config
Extracted
Path
C:\0_HELP_DECRYPT_FILE.html
Ransom Note
<html>
<head>
<meta charset="utf-8">
<title>0_HELP_DECRYPT_FILES</title>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background-color: #EDEDED;
}
.bold {
font-weight: bold;
}
.xx {
border: 1px dashed #000;
background: #E3D5F1;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">What happened to my files ?</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] or [email protected]
</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>0C F8 8C 61 CD D9 9A C9 7A 43 34 30 67 73 95 49
C6 72 FC D2 72 4B DD 93 97 FE 69 29 BE 9E B8 C6
BB 1E 01 1B 04 2D 13 78 BA 7E 8D 7C CF 6C 1F 2A
39 AE E1 B5 57 52 B8 9C 86 38 77 2A AA 13 FC C8
F1 21 30 AE F2 64 84 7B A9 08 03 52 06 57 94 D1
97 85 D5 4A 28 14 BA 9E FC 84 A4 CA 77 D0 A2 5A
0C 1E 1D 57 8A CC 6D 19 B9 55 EF 6E 22 BA 7C D8
9C D0 60 4D 5A 26 7F B4 38 F8 68 EF 71 B1 9B 88
E4 28 FD 95 39 7F 4E 1C B8 C9 D6 92 50 6B AC CC
AE D3 44 0F B4 2C 5F CC D2 A9 4D CC E9 9A C8 79
AB 52 4D 1C 69 46 61 AD 14 AF 5B 50 82 AF 67 4E
3D C0 D1 52 74 FE 74 6C 4F 2A BF 3F 3D F8 9A 14
3E 20 81 14 9F A5 2E 0D 61 EA C5 05 5A 3D D4 D6
F7 E9 EA 2C C4 C0 4E B9 76 7E 79 97 A6 1A 57 E8
BA 33 78 6C 4B BD 2A 95 FB 99 42 BB 78 9A BA B2
6A 6F 40 A0 1B BF 00 6C B0 85 78 48 4A F2 4A 41
</pre><!-- !!! CTpoкy He MeHяTb !!! -->
</div>
<div class="bold">
<div align="left">Write this ID in the title of your message</div>
</div>
<div class="bold">In case of no answer in 24 hours write us to theese e-mails: [email protected] or [email protected]
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files</div>
<div>
<h3 align="center">Free decryption as guarantee</h3>
<h5 align="left">Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </h5>
<div class="note xx">
<div align="left">
<h3>How to obtain Bitcoins<br>
</h3>
</div>
<div align="left"> <strong>Here are our recommendations:</strong> </div>
<div align="left">
<li><strong>If you have no Bitcoin address register https://blockchain.info/wallet</strong></li>
<li><strong>fill up your wallet some of the ways:</strong></li>
<li><strong>Btcdirect.eu - Good service for Europe</strong></li>
<li><strong>Bittylicious.com - Bitcoins through Visa / MC or through SEPA (EC) transfer</strong></li>
<li><strong>Localbitcoins.com - Here you can find people who want to sell Bitcoins directly (WU, in cash, SEPA, Paypal u.s.).</strong></li>
<li><strong>Cex.io - buy bitcoins with Visa / Mastercard or Wire Transfer.</strong></li>
<li><strong>Coincafe.com - Designed for quick and easy service. Payment methods: Western Union, Bank of America, cash by FedEx, Moneygram, as money transfer</strong></li>
<li><strong>Bitstamp.net - well known and established Bitcoins seller</strong></li>
<li><strong>Coinmama.com - Visa / Mastercard</strong></li>
<li><strong>Btc-e.com - Bitcoins vendor (Visa / Mastercard, etc.)</strong></li>
<li><strong>If you have not found any bitcoins in your region, try to find them here:</strong></li>
<li><strong>Buybitcoinworldwide.com - International Bicoins Exchange Directory</strong></li>
<li><strong>Bitcoin-net.com - Another directory of Bitcoins sellers</strong></li>
<li><strong>Howtobuybitcoins.info - International Bicoins Exchange Directory</strong></li>
<li><strong>Bittybot.co/eu - Directory for countries of the European Union</strong></li>
<li><strong>write to Google how to buy Bitcoin in your country?</strong></li>
</ol>
</div>
<div align="left">
</div>
<div class="note alert">
<div class="title">Attention!</div>
<ul><li>Do not rename encrypted files.</li>
<li>Do not rename encrypted files.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
Extracted
Path
C:\0_HELP_DECRYPT_FILE.html
Ransom Note
<html>
<head>
<meta charset="utf-8">
<title>0_HELP_DECRYPT_FILES</title>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background-color: #EDEDED;
}
.bold {
font-weight: bold;
}
.xx {
border: 1px dashed #000;
background: #E3D5F1;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">What happened to my files ?</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] or [email protected]
</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>8C 42 2A A3 33 42 70 11 8D 5B 68 59 EB C7 F5 6A
0A 4C 51 85 8B F1 9A 46 F2 6A 4A 83 29 A0 DE A1
5A 2B 01 B0 46 E8 EF F3 42 F8 B2 50 0A 04 E0 B5
29 B8 61 89 51 81 24 B5 75 B0 54 FA 97 9A D2 BD
BD ED 3F D8 BD CC 75 47 E9 19 8E 64 7E 62 F8 EF
BD 5B E7 34 7B 15 EC 71 B5 32 B7 EF 1F 77 80 2C
C8 65 88 1C 01 21 A6 AC FF 75 C1 95 AF 2E 18 93
C4 9A A4 36 09 67 0A 4A A5 68 55 35 30 4D A4 F7
AD 2B 35 9C F5 D3 FB 21 B6 59 35 88 23 8A 32 6C
D0 30 A2 03 2F 87 6A AF 02 68 36 BE C8 DB FF 5E
DF A7 08 61 78 26 DB DF A5 5F 6C 17 0A 3F EA BE
13 E2 35 A6 D5 CA E6 BD AC F1 1F 78 EA E0 04 2C
9C 68 C2 83 CF 8B AC 77 74 1E D8 A6 64 D0 9E 74
37 9C A0 FB 00 69 5F 78 EE 40 DC 5E 52 50 A5 4F
0D 4F 5D 24 C0 88 58 29 E2 EB D6 C8 73 6A 32 6F
FA B9 5E 52 30 68 FF 60 07 54 CA B7 C4 77 7A C1
</pre><!-- !!! CTpoкy He MeHяTb !!! -->
</div>
<div class="bold">
<div align="left">Write this ID in the title of your message</div>
</div>
<div class="bold">In case of no answer in 24 hours write us to theese e-mails: [email protected] or [email protected]
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files</div>
<div>
<h3 align="center">Free decryption as guarantee</h3>
<h5 align="left">Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </h5>
<div class="note xx">
<div align="left">
<h3>How to obtain Bitcoins<br>
</h3>
</div>
<div align="left"> <strong>Here are our recommendations:</strong> </div>
<div align="left">
<li><strong>If you have no Bitcoin address register https://blockchain.info/wallet</strong></li>
<li><strong>fill up your wallet some of the ways:</strong></li>
<li><strong>Btcdirect.eu - Good service for Europe</strong></li>
<li><strong>Bittylicious.com - Bitcoins through Visa / MC or through SEPA (EC) transfer</strong></li>
<li><strong>Localbitcoins.com - Here you can find people who want to sell Bitcoins directly (WU, in cash, SEPA, Paypal u.s.).</strong></li>
<li><strong>Cex.io - buy bitcoins with Visa / Mastercard or Wire Transfer.</strong></li>
<li><strong>Coincafe.com - Designed for quick and easy service. Payment methods: Western Union, Bank of America, cash by FedEx, Moneygram, as money transfer</strong></li>
<li><strong>Bitstamp.net - well known and established Bitcoins seller</strong></li>
<li><strong>Coinmama.com - Visa / Mastercard</strong></li>
<li><strong>Btc-e.com - Bitcoins vendor (Visa / Mastercard, etc.)</strong></li>
<li><strong>If you have not found any bitcoins in your region, try to find them here:</strong></li>
<li><strong>Buybitcoinworldwide.com - International Bicoins Exchange Directory</strong></li>
<li><strong>Bitcoin-net.com - Another directory of Bitcoins sellers</strong></li>
<li><strong>Howtobuybitcoins.info - International Bicoins Exchange Directory</strong></li>
<li><strong>Bittybot.co/eu - Directory for countries of the European Union</strong></li>
<li><strong>write to Google how to buy Bitcoin in your country?</strong></li>
</ol>
</div>
<div align="left">
</div>
<div class="note alert">
<div class="title">Attention!</div>
<ul><li>Do not rename encrypted files.</li>
<li>Do not rename encrypted files.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
Targets
-
-
Target
53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718
-
Size
105KB
-
MD5
467cceb1ab90bf50dc35f65dc513a483
-
SHA1
907c7792120b5aee6970b4b13747a729fbd59f7d
-
SHA256
53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718
-
SHA512
e85f314c33cb521ea3dabec4b2fcfde61a5bab2e5b06a2eb0268f0c35c510318a6510dd77bc2bfa11b7350533adf659895a440ee1496d335843dfad712121f1c
Score10/10-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-