7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a

General

Target

7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe
Size

586KB
Sample

220322-p476qsbebq
MD5

55b95e36469a3600abb995e58f61d4c9
SHA1

de6717493246599d8702e7d1fd6914aab5bd015d
SHA256

7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a
SHA512

9b2eceff54340057b3eae7391b7c5205c3b2d6d13299b4b918fb1d1a5f6f1006079fc4c58b9dd589738927cf0580f5050c4e61448dd82a8d089f2ea9ddcb5e0a

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!-Recovery_Instructions-!.txt

Ransom Note

! YOUR NETWORK HAS BEEN COMPROMISED ! All your important files have been encrypted! ANY ATTEMPT TO RESTORE A FILE WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. No software available on internet can help you. We are the only ones able to solve your problem. We gathered data from different segment of your network. These data are currently stored on a private server and will be immediately destroyed after your payment. If you decide to not pay, we will keep your data stored and contact press or re-seller or expose it on our partner's website. We only seek money and do not want to damage your reputation or prevent your business from running. If you take wise choice to pay, all of this will be solved very soon and smoothly. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us. restoreassistance_net@wholeness.business restoreassistance_net@decorous.cyou In the subject write - id-VAa87a901aef

Emails

restoreassistance_net@wholeness.business

restoreassistance_net@decorous.cyou

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!-Recovery_Instructions-!.txt

Ransom Note

! YOUR NETWORK HAS BEEN COMPROMISED ! All your important files have been encrypted! ANY ATTEMPT TO RESTORE A FILE WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. No software available on internet can help you. We are the only ones able to solve your problem. We gathered data from different segment of your network. These data are currently stored on a private server and will be immediately destroyed after your payment. If you decide to not pay, we will keep your data stored and contact press or re-seller or expose it on our partner's website. We only seek money and do not want to damage your reputation or prevent your business from running. If you take wise choice to pay, all of this will be solved very soon and smoothly. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us. restoreassistance_net@wholeness.business restoreassistance_net@decorous.cyou In the subject write - id-VA994b5ede65

Emails

restoreassistance_net@wholeness.business

restoreassistance_net@decorous.cyou

Targets

- Target
  
  7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe
- Size
  
  586KB
- MD5
  
  55b95e36469a3600abb995e58f61d4c9
- SHA1
  
  de6717493246599d8702e7d1fd6914aab5bd015d
- SHA256
  
  7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a
- SHA512
  
  9b2eceff54340057b3eae7391b7c5205c3b2d6d13299b4b918fb1d1a5f6f1006079fc4c58b9dd589738927cf0580f5050c4e61448dd82a8d089f2ea9ddcb5e0a
Score

10^/10

ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops desktop.ini file(s)
behavioral1 behavioral2