ako

General

Target
1-de.bin
Size 819KB
Sample220424-ecsa4acbfm
SHA256 a5eb835060919717bdddb6d66b08618586d55bfb41ccef791c4b5beb7ee319a3
MD5 865a58f7fc861377f98d933165690110
SHA1 d8ed586d83e3b37abc0b439ea175799769e9eec5
SHA512 aab5cd363912a01268afe5fdbb769b50754c1f81d1447116826c0d832e988b2bd1d82386bbe9b088547b5094ec3b0ad26c9d7d5d1ebff1a8992492157616cc7c
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ako-readme.txt

ako

Ransom Note

Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .0ZaqOC Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuMFphcU9DIiwgImtleSI6IjhVdmV6TW1mMHhEZW53WlpsbG5RbHo veHdXTXZYTjYyKzJhN09aaFpQTlFWWnl3WXhPQWlNQ1JvSDBVSXBzMjFrcWtKN ldYYVhlckw5U1Vkc2xXM29tVStoSmNPQnd1Vm9Kd0lKcXNVR2xtc0xJazNVcHN TN2czM2ZNTmRteUFxcU1sMUJMc3JyR3g1M3BwZDRselZTTUZLVzlLb0dMNnB5Z 2I5clJIMUxWdjlhd3BwLzliaWplT3JZcTJIdXpoa0g2NFFuRG1malZtdE9rRnB qNllTK3BFVmJDM0hFZlVsczAvUE1zMGdRc1JKT2U2QytwQk9pUXlPOEhHclpsS nMyK1psTFU1TTJDTkR6TUE2VHE5UDdNWmNLeXBoWlJOeSswQ1RyakZmUCtERkQ 5SkdoV2lRclZKZWExZkV0eXc1QVlqZ1ZSdkdHUE5hNnlwTHpkeTFpZz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---

URLs

http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB

Extracted

Path

C:\ako-readme.txt

ako

Ransom Note

Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .0ZaqOC Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuMFphcU9DIiwgImtleSI6IjEwTDRsWXNveVltRlgzUGVaTUJXNGp iV0M4dXc0RGRWUUhhY3FTSTI2WVlqR1hrUVl6bTI2V2FsRjFYdXdDSTJaaDFxa lNyUGJJNWZkS0JDeGFGT1BIR0M4QnBFWGxOTHBWd21hbGhWZ0E0NCtoYWU2akp xQ0g2SE9ONExXanlQTERFbkNVVVRtSEsxVFh1WlZab2c1bXpyK2hraU9nTDNpQ URsZzJIaWUvdS9YK0NycWlPc0JGbG5Sa1dOcU5kM3NGa09xYnpNK2ZuZUViS0p YRHFSby9IeHUvTGhuZ1RrOEU4SVdNZ2lERkd5MmN1TDlhZU1PcWo2cHQ1NlB3U DFpU1E2cjFFck1yUmhLU2VJWG55ek1aSlUvcVE1dW5BaWRuS0wyWjF4Q1dnNUN vMDByYWJoRUkxYVlPUlh0TWtZVSs5dThrR0VtcEZQcVhrVzlyNExzQT09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---

URLs

http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB

Targets

- Target
  1-de.bin
- Size 819KB
- SHA256 a5eb835060919717bdddb6d66b08618586d55bfb41ccef791c4b5beb7ee319a3
- MD5 865a58f7fc861377f98d933165690110
- SHA1 d8ed586d83e3b37abc0b439ea175799769e9eec5
- SHA512 aab5cd363912a01268afe5fdbb769b50754c1f81d1447116826c0d832e988b2bd1d82386bbe9b088547b5094ec3b0ad26c9d7d5d1ebff1a8992492157616cc7c
- MD5 SHA1 SHA512
Score

10^/10

ako evasion ransomware spyware stealer
- Ako
  Ransomware strain discovered in early 2020.
  ransomware ako
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2