locky

General

Target

4e17fb5415d3bfbf419afe186e0a3ed1c6478bddf9fb9b996e98f6318456a7e6
Size

169KB
Sample

220305-1qt8hahda5
MD5

9e1bea5f036a2e74d0d340bcac07b038
SHA1

f0d4e2bdacea8dd240599fbf24c364e05e58dbe0
SHA256

4e17fb5415d3bfbf419afe186e0a3ed1c6478bddf9fb9b996e98f6318456a7e6
SHA512

45c431d4a29581ba0766973ac626b533924fd19aad5c5f5dc80420ec53ece75ddb6817eb20e4ed04d9ced696e71aa9f0fb2434161f2beb0d862e9774ff87bbb3

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\!!Read_Me.4D14D.html

Ransom Note

<!DOCTYPE html><h1>#ALL YOUR FILES ARE ENCRYPTED AND STOLEN BY RAGNAROK</h1>Dear Sir Your files are encrypted with RSA4096 and AES encryption algorithm. But don't worry, you can return all your files!! follow the instructions to recover your files Cooperate with us and get the decrypter program as soon as possible will be your best solution. Only our software can decrypt all your encrypted files. What guarantees you have? We take our reputation seriously. We reject any form of deceptionYou can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain any valuable information. When hiring third-party negotiators or recovery companies. listen to what they tell you. try to think. Are they really interested in solving your problems or are they just thinking about their profit and ambitions? By the way.We have stolen lots of your company and your private data which includes doc,xls,pdf,jpg,mdf,sql,pst... Here we upload sample files of your company and your private data on our blog : http://wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion We promise that if you don't pay within a week, we will package and publish all of your company and your data on our website. We also promise we can decrypt all of your data and delete all your files on internet after your payment. Such leaks of information lead to losses for the company. fines and lawsuits. And don't forget that information can fall into the hands of competitors! For us this is just business and to prove to you our seriousness. Our e-mail: [email protected] Reserve e-mail: [email protected] [email protected] Device ID: ==AAA81NzEjLw4yNyEjLwEDLRlVTId0STFFLyQkQBFUN4AzMFRERxkTM3U0N2YUR0M0MENkR1Q0QCNUMFVzM0IENwIEO4YTO1IzM2IEMBRUNDN0NBFTMCZUO2QDOwITQFFTO5U0MyMER5kjMzQzQBFTM5QDRCZUQBZEREdDN4YjQBZUM5IERzUjN3IDM1ITO2Q0QyIUR2I0QEJDR0UzM0EjRCJTQ3EzM3AzQFR0M5UEOEV0NycDR4QzMxMTQ2YUM2UTO2UENBZTO3cTRDJEREJ0NGlzMyMzMyY0N4gjRCRENFJEO5kzNERUQ4EkMCdzQGBTO1gDOxgDO0ITQ5QDRzEkQ5QDRGNkRGRTMxMUQxEjRxgjNEBjR2czQBhTN3IjRyEkRyMTQ0kDRBdDR2IjQwYDM1IUOGBzQwQkRxUDO1YjMzUTRGV0NzUzQwEkMyIDOxMUM4QERFRkM4ETOyQDOEJTMDNTRzcTMxYUOEFkQ1QEOFZUM2IDMDVTR1UDMCRzQ0EEO3ITRBBTQzIUMwgTNEZUNCRkQyEERGJDNFBDOwITMzY0QBZzNERTNwIUN0UkQzI0NxYEM5kDOyQTM5UUO3EkMFJkMFRDOxYDNyYTN1E0MwcTQxgjQwcjRyUERFFUR4IjQGNEOwUzQzcDOBhDRGZkR1czNFRDR2ETN0QUNDFUOGlTM4YkNFZ0NBBjQGlTMBFTO2AzNxkDMzYzMyMDM1MUR4MTOFZzQBFjRDhjNEdjRCVTM0MEMxkTM0YEO2IEOwUERwE0NyIjN1kjR3MEMyI0MyIDNwEkQ4UkR4MzQGFzQzEDN4czMxgTN2kDMCZERDRkMzQEMwkTM3kDNGRTOwUUNxcDNENTRBlzQ1YTO5MzQEdTM4EkRxUTN3MTR1IURxQUNCFkN4YkN5cDMEN0QGZjRwADMENjNxIDRGdzQDFjNBNkMzIjN1cjQxYTMzETQBhzN4gzMChjNyQUMDZUM3gDM5EDNDFzQ3cTNwUTR0QTO1YzQGVUNDZUM1cDOyMEN3kzN2MTN5QzNGZ0QyQkR5ETRzMTN3IUO0QkRGZERzQzNwE0MBFDO1EjQyMEMwUEREVUQ2cjMEZTMwcTMDFUN0EjRElzQ2UjRBVzM1MTM2cDRyQUMwgTN2IkR1U0NFZTRGJkMzUTOElzN1kzQEFkRCVjRwcTRwcTNCVTOxczNBNTOBdjQFhDMCVzQGlzN1YUNEVjMGljM0U0Q0UzNCRzNxADMDJzMBhjN0UjM4IjR2UEM3YjMxkzQ4EDOBR0N2M0MCVjNGlDM0AzM3IzMDRDNDljMGdzQ2ATNzMUMyQTRGVUQzMDO3QDOERTNFRUN2EkQ1YzN0QUN4UEN5EjR4EUOzQjN3kjRwUTO5MDNwYUMxADMxIjMyATN2QTQ1wCOxEEMChzM4MkN0I0MGBzNxEUQxkDM3QTRzEDNClTM2QjM1IUOxUkR0MzQ3MUR5YTNyIDRwUEOElTN5gDOERDNGZDM3IkQyIERDlzQwcjMEJDOxE0N3MDNwYzMyE0Q3UTRChTO2cDRBdTMEJzN2IkM0YDO2YjQ1UURxkTO3ATN4E0NycTQxATQxYERENjN2UENDNDM3UUR5UTMDVTREJzNGRkR3czQDdDO5gTQ4IjN4gTMxYzMwQ0NCJDRyYTNCNER4UUQzY0NzUTNCZjN0Y0MxI0M0MEMFR0NxEUMxczQBVTNzQEOzIUN3cjNBRjM2IkQ4ITMGdjNCJTOzIURxEkN0QUO4IkMBRzMzYUNCRUM2IkN0MTODRDMBhDOBJ0NwEzMDVTRFlTNFJEM0UDMFRUOFJEO2QDOBBzM3ETO3YUQwADOFZjN4M0M5ATN3IkRwYkNzQjQxE0MCFDOCFTR1MjRxczQ1YTOGBjN4QkQDJTNwIEM1czNyUUOGdTN3gjQ0ETNzIUNFZzQFBjMDFDNwUDN4EUR0YkM1UDO1IUM1I0Q1AjN4ADR1cTN3EDOGV0QDZkNxkjMBBDOBNjRwIUQEJEMEBDRCVTM0kDRyEzNCRjQwAzNwQUMyEUR0QzNzQTRDlzNyIERxIUN4ETMCNENxUjR1cTNCFENwMTOEF0MGJzQBRDNxQjM0IUO1MENDNEOzIkM0cTQwMzM0AjQFNUNBBDMElTQGRENxgzQBhDR5YDOBRDO3IjQ1MDNwUUNxM0N0ADR2cTRCZTO5EURxUERFJjR2YUR5kjR5QTR1kDN2QkQ5kDN3E0Q1AjM2czNENjMFVDR3UTQ5YjR1IUOyAzQ3ITRDZ0MFJUO4cDRFRkR4EDRzkjQwUTNFVTMBJkMGNkMCZUMwITM0I0NEZDM5U0M3UDOGRUOCFDR0gDO1UzQDJzNDBjRClDNxgDOzEjRzYDNEdzMFFTO5YzMzQDREBDOxY0Q5Q0NzEENGVUMxM0QCZzMwEjRxADR2MTOCZUQzkDNxIDN3QDRyU0QERzQERjQzYjRCljN5M0QCRTM2kTQxIjMyIDN4EzM2MkQyIkM3EjR2QUR1QTOFNEM2kjQBFEM5cjR0ETMDNjMBR0N3MzMBFjQ5YDOBVzMzYDRBdDOBVEMDZDRGF0QzQUR4kDMyIUMwE0N2YDOCdzMzkTQDREMzYUN0YUQ2ADMxgjQzQkRyAjM3gTOGBTMGZjNwEkNCNkMyMzMGZEMEhDOEVzQxQUQBZTMFlDM3QUQ0I0NBNTNBlDM3QDNDJzMxADR2cDOBBTRwEDOCBjMwITNyMEN1QzN5M0NwQjQ1MEO4kjMyMkQBdDOxYkNClTM0kjRBZkQDhTO4cDM

Emails

[email protected]

e-mail: [email protected] [email protected] Device

Extracted

Path

C:\!!Read_Me.FCB7A.html

Ransom Note

<!DOCTYPE html><h1>#ALL YOUR FILES ARE ENCRYPTED AND STOLEN BY RAGNAROK</h1>Dear Sir Your files are encrypted with RSA4096 and AES encryption algorithm. But don't worry, you can return all your files!! follow the instructions to recover your files Cooperate with us and get the decrypter program as soon as possible will be your best solution. Only our software can decrypt all your encrypted files. What guarantees you have? We take our reputation seriously. We reject any form of deceptionYou can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain any valuable information. When hiring third-party negotiators or recovery companies. listen to what they tell you. try to think. Are they really interested in solving your problems or are they just thinking about their profit and ambitions? By the way.We have stolen lots of your company and your private data which includes doc,xls,pdf,jpg,mdf,sql,pst... Here we upload sample files of your company and your private data on our blog : http://wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion We promise that if you don't pay within a week, we will package and publish all of your company and your data on our website. We also promise we can decrypt all of your data and delete all your files on internet after your payment. Such leaks of information lead to losses for the company. fines and lawsuits. And don't forget that information can fall into the hands of competitors! For us this is just business and to prove to you our seriousness. Our e-mail: [email protected] Reserve e-mail: [email protected] [email protected] Device ID: ==AAA8VN3EjLx4yNyEjLwEDLSB1TYBVUEpEL3Q0M5U0NCJEMCdTR4QkNFNDOwIzN4MjM0Y0M5czQCBjN3IUN5kjMzIUNEhDOCFEO4IzQCdDR5EUMwEkR0MERCRDRGlTM1YDMBJEOBVzQ2gjMDhzM0IUNElTM1Q0MFZ0N5EzQCBzN1AjQCR0Q1ETM1IzMwYzQEFDNwYDN5MUOEREOzkjQ5IEN5ITMBJ0NwQjQGBTQ3kjN0ITMwMUM1QkQzcjRBRzN2YDRycjMFF0NDRUQ1IENBZkRzkjQzMDNxM0QGRjRyETOGJkQFJzN3YENxUTR5QjM4kTMDVzN4kTQEF0QFBjR2ATQ4AjN0czNDhTO2gDN1IkQ2kjQBFDMGZTMDVUMzETM4EDN0MzMEVDM5I0QzEDR0EUMwEzMzMUMxADOzYzN0MkQ4ETRyMkMCV0MwIUQEFjNGVjQ3MDO5YkQ3EjNBV0QChzQCZUM4kDMFVzMzUUOGdTOGJzNCNTQFZUNEhjR3YjMxcDNxAzNBBDR4gTQGlDOzMDRFlTMxYjQFZkMENEN1kTRFJ0NFRUQyQDMGZjR5MURGRzQCFDMCNjR3kzMDJ0QyczQxADRCBTMxQDMzkzQ3U0MBljNGhDO3IDRCFjRxczMwYDO5M0NygDOElTRwADRFlTQ2gDMDN0M1kjQ0ITN0QjQDljQEdjN5EEM4gTOGREOGNDOBlTREdDOCNEOEVUQ0gzQ3ETOCFUOwUjM3cjQDFEOEFDMBJURCVkR5I0Q3kjNzYzNBFDMDdDMEhzNGJURBNzQzI0Q0UTM2MkMwEUNGRkMBFDOBBDOxYUQwgzQ5YTQDV0Q5YDRwUjR2ETQxgjN2IEM5UDNGFUOFlTQ5MjNGdDOGRTRwgTQ3ITM4cTM4QkMyYTN5U0Q1IkM3IzM2QkN1cTRGhTMyQjMzgjQFZTMwEzN4ADNzQ0QBV0QxEUMEVjM1YjMDZjNwMDOzYERGJTMzYUNwIjR5IDN4UTQGlTOFlzNDhjNxAjRDdDODFzQFJTQ2MTOERUQ5gDRwEEOFRTOzE0M4IDRDVER1QEO2gjQCRjNzMkNzYzMEhTM5QDR4EkN1U0NwMENDZjNxUERBR0NzY0MwkjMzQzM1cDRCVUQykjRGFjR5MTNBZjREFDOCdDOCBzQGBjR1YzN2U0M1UkM5kjRzEEN2kzQzIDO5IUOBJjRwgjMDFUR0QkNwQTQxEUO3IERFRUN3M0NwATNxU0NBVjQ1gjQ4YDRDFTOzYERyYDNDFkQzIEO4QUMDVjNCZURBdTMzUzNFFUREZUQwgzQGFEOBdTO5YENBZjM3ETNDRDM3kTRzEDMBZUNFNkNFFEMzMTNEhTM4MjMFVTO4MUM5AzMGljMwcTNwMkQEZ0M4QzQ2MjQBZTMGlzQ5wSOGdzNyMURCRTQyMUQFZER3UUQ3QDN5gTNxUUOCJDR2ETMEZkN1UjR4ITQGZkRyMTQDFTOwEzM0EERGljM4cTN3UjMBBTO0MDOFljMFdzN2kjR3gTM1UEMygDR5AzQ0gTOzEEN4QERwITN0QUQCVjQxIjQDJURDRER2MUNEVEN1QjQGljMzkzQyAzMzUzM4YjREFzMzITOwkDNyQDMBJ0Q1IkR1cTMzYDN5AjMFF0QwETQ4ADMwcDNGNzN4QEODV0M2ITMDFUN4QkR2ITNBJURCBDRyMEM1MUQ3gzNFljQ2UzQxgDO0MDOFVERzITQENUQGRjNDNTMBJDOzIUMGZkM4cTQzIjQENDM0EDRwAjNxE0NzUEN2IURCVzQ3QDM1QkNyEDMyAzMFBDNyUTMwQDMwkjRxIjQBhDNERkN0MEM0MUO2EDR5ADN5kTOwYzQ2IjN0gzQCVjMGFUM3U0N5gDM0kTOGVTO2QkNDdDR5EENyEkQwUjMxQTMBVzQFJUMGZjRBRUOCdDOCFUMzUDM2UTR5czN0UkRwEURBR0MGNEOGNDMEJTQBVEMwU0N5QDM2QDOBFEO4QTQBJzN1EkNxUjN5IUQwkDMGJER5YkMzY0NFRUR4ETOyUDN5QEMCVTO3YUOBFjRCJjM5QkRxMjMCVjR5kDN1gzMBVUMBVUOzYkRzMjQ2MTM3EUNDZDNGdzMGFjN1UTRGVUQFBjNBRDMGhDO2QTOEVDMzM0NzMER1AzQzczQxkjQ3cTR0QURENUQ2ETO1EDNwEENxIkN2EUOyYDOCF0NyczNBJER1YEO5MURyQTQwIEN3AjR2I0Q0cjM5MERGNzN4QTMBZEOzEEOGFTMBJkRwUTMFZkRzYkN4QzNEFTR2EzQ0IUMwUDMCdTN4EUQ2UkNBFTM0YzQzIzNGFUNwYDRGhzNwUTQwYjQGhDRGFjM3EzQwcjN4IUMDljQFZjM1QDMFdjQ2YUM0MDOEJjM3I0MzI0M1gjNGN0N4EDO2YTR1YTR1kTRCJUNzczQBhDM0AjQ0czQ4YkR2YzM4YER0kjMyMUNERTOCFUR3YDOwYjRFZURBdDM2QjNCRjRDRDOwQTQ3YjN5QkN0UjN0ETR0YzNwEDNFFTREJERxYTRFZUOyAjMDFTMCdTOwEENwgjQxgjRFJTN5IUNFRDRyM0Q4QUQ1Y0QwMEMwUkR4I0NwAjN0UTRGNjQGJkN3cDNyYER4YTMCNDO5EUMCRzNyUzQ3QUO3ITR4YjR4EUR1MDOyUUQGRTMGVjM1gDR4EUNDBTMFhzMzYzM5AzN1gDRGBjRxYUNxQEO2Y0QCRzQyYzQBFjM4gTRDhDNyUDN3IDO3QzQygDN4IzN4kTNxQzQDdzN

Emails

[email protected]

e-mail: [email protected] [email protected] Device

Targets

- Target
  
  4e17fb5415d3bfbf419afe186e0a3ed1c6478bddf9fb9b996e98f6318456a7e6
- Size
  
  169KB
- MD5
  
  9e1bea5f036a2e74d0d340bcac07b038
- SHA1
  
  f0d4e2bdacea8dd240599fbf24c364e05e58dbe0
- SHA256
  
  4e17fb5415d3bfbf419afe186e0a3ed1c6478bddf9fb9b996e98f6318456a7e6
- SHA512
  
  45c431d4a29581ba0766973ac626b533924fd19aad5c5f5dc80420ec53ece75ddb6817eb20e4ed04d9ced696e71aa9f0fb2434161f2beb0d862e9774ff87bbb3
Score

10^/10

locky evasion ransomware
- Locky
  Ransomware strain released in 2016, with advanced features like anti-analysis.
  ransomware locky
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
behavioral1 behavioral2