hydracrypt

General

Target

1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2
Size

164KB
Sample

220608-dvdd8aagf5
MD5

5f2d13576e4906501c91b8bf400e0890
SHA1

adff2761a6afe9ecaa70486c0a04746c676a133b
SHA256

1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2
SHA512

29186d7c1702ab738844777a780ce982882727d8fb3ae6e1fd084bffef3ac63fcd7ca4624ee9bf047c909c303deece27f81650b1309280d6609d207e29131dfd

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_DECRYPT_HYDRA_ID_d3e7b4d.txt

Ransom Note

Attention! All Your files and documents were encrypted! Encryption was made with a special crypto-code! There NO CHANCE to decrypt it without our special software and your unique private key! To buy your software You need to contact us by EMAIL: 1) [email protected] or 2) [email protected] Your email text should contain your unique ID number and one of your encrypted file. We will decrypt one of your file for FREE! It`s your guarantee! Remember! Your time has a limit: 72 hour. If You will not send any email We will turn on a sanctions: 1) Your software`s price will be higher 2) Your unique private key will be destroyed (After that your files will stay encrypted forever) 3) Your private info, files, documents will be sold on the Dark Markets Attention: all your attempts to decrypt your PC without our software can destroy or damage your files!

Emails

[email protected]

Targets

- Target
  
  1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2
- Size
  
  164KB
- MD5
  
  5f2d13576e4906501c91b8bf400e0890
- SHA1
  
  adff2761a6afe9ecaa70486c0a04746c676a133b
- SHA256
  
  1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2
- SHA512
  
  29186d7c1702ab738844777a780ce982882727d8fb3ae6e1fd084bffef3ac63fcd7ca4624ee9bf047c909c303deece27f81650b1309280d6609d207e29131dfd
Score

10^/10

hydracrypt persistence ransomware spyware stealer
- HydraCrypt
  Relatively unsophisticated ransomware family based on leaked CrypBoss source code.
  ransomware hydracrypt
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2