General
- Target af24612700c0105cf990148b19e5140314a55701c7022ccd2811e8ee29d68d74.bin.sample.gz
- Size 15KB
- Sample220217-wnmcnacha2
- SHA256 012532729ad9c1e9495a65d1961a9f66cb7b5ae6c6aa18b919241e0029091d42
Score
10/10
Malware Config
Extracted
Path
-
C:\restore-files.txt
Ransom Note
- ╔════════════════╗ ═╣ What happened? ╠═ ╚════════════════╝ All of your important files have been encrypted and all sensitive data was stolen. The only way to restore your files and keep your data from going public is to contact us. After a payment has been made you will be given access to decryption software. As a quarantee we will decrypt 3 files for free. If you don't contact us within 72 hours the price will be doubled. ╔══════════════╗ ═╣ Instructions ╠═ ╚══════════════╝ - Download qTOX messanger from https://qtox.github.io/ - Send message to this Tox ID: 3728E933284CE638D06FCF1CBE921096E102508BD370D6D23137D3271EE5733825F63F56805E Your message should contain your Unique Key: 53566134903697098455
URLs
-
https://qtox.github.io/
Targets
-
- Target sample
- Size 30KB
- SHA256 af24612700c0105cf990148b19e5140314a55701c7022ccd2811e8ee29d68d74
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.