snatch | 9a18e445b1dc26e179e43bcc64a8c4580a300fe0ddfa02a1abb9d6380ce96326

General

Target

9a18e445b1dc26e179e43bcc64a8c4580a300fe0ddfa02a1abb9d6380ce96326
Size

4.6MB
Sample

220305-x3s97ahah2
MD5

3f1c123e7a80fef58cf0d2e55f5a74f2
SHA1

4dbb92b7af113b25c4fc1c4ce75fd1e8800a82e0
SHA256

9a18e445b1dc26e179e43bcc64a8c4580a300fe0ddfa02a1abb9d6380ce96326
SHA512

1963b1aa61c6ce561d00f6db6221b7381e28fc02eb1237320e133aec6d5e0e13cc72151a9033026cf8269cd828ec7de3568f2e8f02509a75a93b8fb413917452

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT

Ransom Note

Hello! All your files are encrypted and only I can decrypt them. Contact me: [email protected] or [email protected] Write me if you want to return your files - I can do it very quickly! The header of letter must contain extension of encrypted files. I'm always reply within 24 hours. If not - check spam folder, resend your letter or try send letter from another email service. Attention! Do not rename or edit encrypted files: you may have permanent data loss. To prove that I can recover your files, I am ready to decrypt any three files (less than 1Mb) for free (except databases, Excel and backups) HURRY UP! ! ! ! If you do not email me in the next 48 hours then your data may be lost permanently ! ! !

Emails

[email protected]

Targets

- Target
  
  9a18e445b1dc26e179e43bcc64a8c4580a300fe0ddfa02a1abb9d6380ce96326
- Size
  
  4.6MB
- MD5
  
  3f1c123e7a80fef58cf0d2e55f5a74f2
- SHA1
  
  4dbb92b7af113b25c4fc1c4ce75fd1e8800a82e0
- SHA256
  
  9a18e445b1dc26e179e43bcc64a8c4580a300fe0ddfa02a1abb9d6380ce96326
- SHA512
  
  1963b1aa61c6ce561d00f6db6221b7381e28fc02eb1237320e133aec6d5e0e13cc72151a9033026cf8269cd828ec7de3568f2e8f02509a75a93b8fb413917452
Score

10^/10

ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2