vashsorena | 0c16d85bb1df90e60909c8c7747d26140a8170e650f1be6251ccf5084a6cac7a

General

Target

0c16d85bb1df90e60909c8c7747d26140a8170e650f1be6251ccf5084a6cac7a
Size

2.7MB
Sample

220302-csph2acch2
MD5

53216ddfbfb976b62964fb920c50a8f5
SHA1

5c7a5de3259e5d1872728d63193c964e38b9dc64
SHA256

0c16d85bb1df90e60909c8c7747d26140a8170e650f1be6251ccf5084a6cac7a
SHA512

1d0edcdba7dde16fac1b936ec41cac00a19e1860d2c42f995bae0108db33143076019e1846a8937a92655152bca6e9ab9e00818b55b8ad0fe33c9088cbf8a2e4

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://zakony-pravo.ru/wp-includes/css/clear.txt

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://zakony-pravo.ru/wp-includes/css/video.mp4

Extracted

Path

C:\HELP_DECRYPT_YOUR_FILES.html

Ransom Note

<!DOCTYPE html><html><body><div class=demo> <h1>All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm</h1> <p>For more information you can use Wikipedia</p> <p>*attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files</p> <p>This is a private ransomware developed by our team and there is no decryption file for it</p> <br /> <p>Updated on : Saturday , November 7, 2020 , 2020-11-07</p> <br /> <p style=color:#f16313;>If you want to solve your security problem, contact us</p> <br /> <p style=color:#f16313;>For Trust You can Send us Test Files And We Decrypt That And Send To You.</p> <br /> <h2>*How do I contact you?</h2> <h2>The only way to communicate is through a secure Telegram messenger</h2> <h2>Telegram ID : https://t.me/decrypt_protected</p> <h2>Your unique Id : BKTTXYEFQ </h2> <br /><h2>How To Access Telegram</h2> <h2>To access Telegram, you must install the version related to your platform</h2> <h2>You can download Telegram from https://telegram.org</h2> <br /><p>#How to recover files?</p> <br /> <p>How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop</p> <div class=VideoDiv> <video width=400 height=400 controls><source src=C:/Users/Public/Music/video.mp4 type=video/mp4></video></div><br /><p>You need two key</p> <p>1-Public key: you need it for encryption<p>2-Private Key: you need it for decryption</p> <p>All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files</p> <p>The private Key that we will send works on all your computers</p> <br /> <p>#How to use private Key?</p> <p>We send you a simple software with private Key</p> <p>And you just need run this software on each computer that encrypted and all affected files will be decrypted</p> <br /> <p>*What are the guarantees that I can decrypt my files after paying the ransom?</p><p>Your main guarantee is the ability to decrypt test files.</p> <p>This means that we can decrypt all your files after paying the ransom.</p> <p>We have no reason to deceive you after receiving the ransom, because it harms our business</p> <p>You Have 24 hours to Decide to Pay</p> <p>after 48 hours Decryption Price will Be Double</p> <p>And after 72 hours it will be triple Try to Contact late and You will know</p> <p>Therefore, we recommend that you make payment within a few hours.</p><br /><p style=color:#d61d1d; >#deadline</p><p>You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files</p><br /><p>#What is Bitcoin?</p><p>Bitcoin is an innovative payment network and a new kind of money.</p><p>You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us</p><br /><p>#How to buy Bitcoin?</p><p>There are Many way to buy Bitcoin and deposit it into your account,</p><p>You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc</p><p>https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram</p><p>https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit</p><p>https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party</p></div><style>Demo Styles*/html {height: 100%;box-sizing: border-box;}*,*:before,*:after {box-sizing: inherit;}body {position: relative;margin: 0;padding-bottom: 6rem;min-height: 100%;font-family: Helvetica Neue, Arial, sans-serif;font-weight: bold;background: #000;}.demo {margin: 0 auto;}.demo h1 { margin-top: 15;text-align: center;font-size: 25px;color: #d34410;}.demo h2 { margin-top: 15;text-align: center;font-size: 25px;color: #16419e;}.demo p {margin-top: 10;text-align: center;font-size: 20px;color: #cccccc;}.demo .VideoDiv{margin:0 auto;background:red;border:2px solid #ffffff; width:400px;;height:400px}</style></body></html>

URLs

https://t.me/decrypt_protected</p>

Extracted

Path

C:\HELP_DECRYPT_YOUR_FILES.html

Ransom Note

<!DOCTYPE html><html><body><div class=demo> <h1>All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm</h1> <p>For more information you can use Wikipedia</p> <p>*attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files</p> <p>This is a private ransomware developed by our team and there is no decryption file for it</p> <br /> <p>Updated on : Saturday , November 7, 2020 , 2020-11-07</p> <br /> <p style=color:#f16313;>If you want to solve your security problem, contact us</p> <br /> <p style=color:#f16313;>For Trust You can Send us Test Files And We Decrypt That And Send To You.</p> <br /> <h2>*How do I contact you?</h2> <h2>The only way to communicate is through a secure Telegram messenger</h2> <h2>Telegram ID : https://t.me/decrypt_protected</p> <h2>Your unique Id : JOJPKUCCI </h2> <br /><h2>How To Access Telegram</h2> <h2>To access Telegram, you must install the version related to your platform</h2> <h2>You can download Telegram from https://telegram.org</h2> <br /><p>#How to recover files?</p> <br /> <p>How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop</p> <div class=VideoDiv> <video width=400 height=400 controls><source src=C:/Users/Public/Music/video.mp4 type=video/mp4></video></div><br /><p>You need two key</p> <p>1-Public key: you need it for encryption<p>2-Private Key: you need it for decryption</p> <p>All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files</p> <p>The private Key that we will send works on all your computers</p> <br /> <p>#How to use private Key?</p> <p>We send you a simple software with private Key</p> <p>And you just need run this software on each computer that encrypted and all affected files will be decrypted</p> <br /> <p>*What are the guarantees that I can decrypt my files after paying the ransom?</p><p>Your main guarantee is the ability to decrypt test files.</p> <p>This means that we can decrypt all your files after paying the ransom.</p> <p>We have no reason to deceive you after receiving the ransom, because it harms our business</p> <p>You Have 24 hours to Decide to Pay</p> <p>after 48 hours Decryption Price will Be Double</p> <p>And after 72 hours it will be triple Try to Contact late and You will know</p> <p>Therefore, we recommend that you make payment within a few hours.</p><br /><p style=color:#d61d1d; >#deadline</p><p>You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files</p><br /><p>#What is Bitcoin?</p><p>Bitcoin is an innovative payment network and a new kind of money.</p><p>You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us</p><br /><p>#How to buy Bitcoin?</p><p>There are Many way to buy Bitcoin and deposit it into your account,</p><p>You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc</p><p>https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram</p><p>https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit</p><p>https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party</p></div><style>Demo Styles*/html {height: 100%;box-sizing: border-box;}*,*:before,*:after {box-sizing: inherit;}body {position: relative;margin: 0;padding-bottom: 6rem;min-height: 100%;font-family: Helvetica Neue, Arial, sans-serif;font-weight: bold;background: #000;}.demo {margin: 0 auto;}.demo h1 { margin-top: 15;text-align: center;font-size: 25px;color: #d34410;}.demo h2 { margin-top: 15;text-align: center;font-size: 25px;color: #16419e;}.demo p {margin-top: 10;text-align: center;font-size: 20px;color: #cccccc;}.demo .VideoDiv{margin:0 auto;background:red;border:2px solid #ffffff; width:400px;;height:400px}</style></body></html>

URLs

https://t.me/decrypt_protected</p>

Targets

- Target
  
  0c16d85bb1df90e60909c8c7747d26140a8170e650f1be6251ccf5084a6cac7a
- Size
  
  2.7MB
- MD5
  
  53216ddfbfb976b62964fb920c50a8f5
- SHA1
  
  5c7a5de3259e5d1872728d63193c964e38b9dc64
- SHA256
  
  0c16d85bb1df90e60909c8c7747d26140a8170e650f1be6251ccf5084a6cac7a
- SHA512
  
  1d0edcdba7dde16fac1b936ec41cac00a19e1860d2c42f995bae0108db33143076019e1846a8937a92655152bca6e9ab9e00818b55b8ad0fe33c9088cbf8a2e4
Score

10^/10

evasion ransomware spyware stealer
- Clears Windows event logs
  evasion ransomware
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2