5222785d721ce9f856d31d7088406589c3afe28256bef0a6fb6214aa8962b722

General

Target

5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.zip
Size

212KB
Sample

220316-jnml7safg8
MD5

f62feba069adc867afa50b3affeff7d0
SHA1

5fbb62212f1344736f647e61b5ccc4b5a2b16e10
SHA256

5222785d721ce9f856d31d7088406589c3afe28256bef0a6fb6214aa8962b722
SHA512

d4fa8448d2eb5c2468e212eab0bba86daaa384e242e418470426e0173ee6fa67d2ff0e9cd9963b21efd00afab19ffc8a0430e34271a78adf762f8d2a4950f823

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\Restore_My_Files.txt

Ransom Note

### What happened? #### !!!Your files are encrypted!!! *All your files are protected by strong encryption with RSA-2048.* *There is no public decryption software.* *We have successfully stolen your confidential document data, finances, emails, employee information, customers, research and development products...* #### What is the price? *The price depends on how fast you can write to us.* *After payment, we will send you the decryption tool which will decrypt all your files.* #### What should I do? *There is only one way to get your files back -->>Contact us, pay and get decryption software.* *If you decline payment, we will share your data files with the world.* *You can browse your data breach here: http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion* (you should download and install TOR browser first hxxps://torproject.org) #### !!!Decryption Guaranteed!!! *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.* #### !!!Contact us!!! email: [email protected] #### !!!Warning!!! *Do not attempt to decrypt your data using third-party software, this may result in permanent data loss.* *Decrypting your files with the help of a third party may result in a price increase (they charge us a fee), or you may fall victim to a scam.* *Don't try to delete programs or run antivirus tools. It won't work.* *Attempting to self-decrypt the file will result in the loss of your data.*

Emails

[email protected]

URLs

http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion*

Targets

- Target
  
  5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe
- Size
  
  218KB
- MD5
  
  0c4a84b66832a08dccc42b478d9d5e1b
- SHA1
  
  160320b920a5ef22ac17b48146152ffbef60461f
- SHA256
  
  5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b
- SHA512
  
  56e4b07baca1c4c82e518088cc713b97eb2aa4e096d39bd7076396e075621bc47a20fd6a65fb897dc974d77c01f242a872532136d4bd3097a57c4664d8430872
Score

10^/10

persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies Installed Components in the registry
  persistence
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2