ako

General

Target
1-de.bin
Size 819KB
Sample220424-ecnmxacbfl
SHA256 a5eb835060919717bdddb6d66b08618586d55bfb41ccef791c4b5beb7ee319a3
MD5 865a58f7fc861377f98d933165690110
SHA1 d8ed586d83e3b37abc0b439ea175799769e9eec5
SHA512 aab5cd363912a01268afe5fdbb769b50754c1f81d1447116826c0d832e988b2bd1d82386bbe9b088547b5094ec3b0ad26c9d7d5d1ebff1a8992492157616cc7c
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ako-readme.txt

ako

Ransom Note

Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .APIjnu Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuQVBJam51IiwgImtleSI6Im5hVzBLMnNEVGxhUTlZdjFxbjlBY1p PZVVqMWMwM08vbldkZ3lKc1pGSlB4WGZEK2UveFlzcTVCSEJUR0h5aThsWTJnc UdXZ3duMy9YYk9LN1NuL1BiY1NkeFBoQXl0OHRNRms5RUFPQU00cjRuZnJxb1V kRVBTNCtJY3QzbXhoUms1V0NleWVJK0gxYnVXaHR3VzVkdzF2SW4xaUprUmQ4U DBiS0NrTTYwY2hWMzgvKzZaZFNvSFpBQUNJRnNFWjN6WHo0b0VwZ01PejdHRkt qWWY0WlFvQkZmOGU5WE1mUzUyUDhVMm9haUFlT3NsdkRWQUY0MnVyZlIzVUdEZ EFOaTdWU1RjTVB2TDEwNGQ1OU5rMlBXM3l2dnFtd0c2RTJ5RnRJOVhPUnhWL2Z hb29IY2FmZ1F2V09ZeHVWcGU0ZDNQNStOTkdveFZtOVNDV3p0bmVsdz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---

URLs

http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB

Extracted

Path

C:\ako-readme.txt

ako

Ransom Note

Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .0ViUb6 Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuMFZpVWI2IiwgImtleSI6IjgyR09PdFJ0S2hqZlZuR2huMGxYZ1V 0UnM3Z1A5LzFGMU5yWFJOVHJiTlZwQ1lNekFLNW5ZdXUrd2RMWUFITDFOQnZUd Wt1Z2w2SHFvekQrWUk3SGsxeWtJMnFGRjlRcy9wOUJSS0svcnFvQXZqTG5keGl uSGQ2YWV4SDBuaDBTdFFPMTFVeVRHWTR3Y1NES2h4LzFZVTRBU0JxRThNSEpHb mtwNGU5YktsWU9wOWNmSmkxa1VLRE9EbzVYS0tITkRObCtKazZ5WkhKRjZybzd 6dG9FaGhmTDhDdE5RR29oandhSTRJZmhieGR0ZVNqNXJlRGhrWm1NdkYyWDdyU VQxK1d3VkxyS0lpZU1QUSszTGFoNDBvTWZNOGxIc0JZVjJWaXh6SjVKK3JHOTh KbW1tMDdSdE1rT3NhaGd1b3BDMUEwUDNOUUhmeEF0cGdqcTVORk9wQT09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---

URLs

http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB

Targets

- Target
  1-de.bin
- Size 819KB
- SHA256 a5eb835060919717bdddb6d66b08618586d55bfb41ccef791c4b5beb7ee319a3
- MD5 865a58f7fc861377f98d933165690110
- SHA1 d8ed586d83e3b37abc0b439ea175799769e9eec5
- SHA512 aab5cd363912a01268afe5fdbb769b50754c1f81d1447116826c0d832e988b2bd1d82386bbe9b088547b5094ec3b0ad26c9d7d5d1ebff1a8992492157616cc7c
- MD5 SHA1 SHA512
Score

10^/10

ako evasion ransomware spyware stealer
- Ako
  Ransomware strain discovered in early 2020.
  ransomware ako
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2