targetcompany | 6a0d713e89b61a8709f8d55e19631ec31370d87880a478704609eee78ccd3c18

General

Target

8e4fa69d87a6d3c6d7e6c699b25cc2ab
Size

161KB
Sample

220224-g66fxsdddj
MD5

8e4fa69d87a6d3c6d7e6c699b25cc2ab
SHA1

e5981cfe6ded85b01b10f4b2a5fc2f8537a63b31
SHA256

6a0d713e89b61a8709f8d55e19631ec31370d87880a478704609eee78ccd3c18
SHA512

fd6ad515c7227a8525e3f3c7b390c547e86b43624424acb978e14d0a7dfa6a90f3cf95518a3b97509f36aed1eb3173dae9d31b6f23990abc232c9dcfb1245994

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\RECOVERY INFORMATION.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. CONTACT US: [email protected] [email protected] YOUR PERSONAL ID: B7B93E5E0B7F �

Emails

[email protected]

Extracted

Path

C:\Program Files\RECOVERY INFORMATION.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. CONTACT US: [email protected] [email protected] YOUR PERSONAL ID: 9B69331CE574 �

Emails

[email protected]

Targets

- Target
  
  8e4fa69d87a6d3c6d7e6c699b25cc2ab
- Size
  
  161KB
- MD5
  
  8e4fa69d87a6d3c6d7e6c699b25cc2ab
- SHA1
  
  e5981cfe6ded85b01b10f4b2a5fc2f8537a63b31
- SHA256
  
  6a0d713e89b61a8709f8d55e19631ec31370d87880a478704609eee78ccd3c18
- SHA512
  
  fd6ad515c7227a8525e3f3c7b390c547e86b43624424acb978e14d0a7dfa6a90f3cf95518a3b97509f36aed1eb3173dae9d31b6f23990abc232c9dcfb1245994
Score

10^/10

evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2