e26b2ffb2ee711fc7b04d62911580560794ee4fa9b7fcfade65ee6ff2eed0274

General

Target

z7w3x.exe
Size

621KB
Sample

220621-nwv1rsfeg2
MD5

753585e5e099b192cf8d7593dd5ef4bf
SHA1

68c5d6b38c9dd9e9e1e888386025352811147028
SHA256

e26b2ffb2ee711fc7b04d62911580560794ee4fa9b7fcfade65ee6ff2eed0274
SHA512

de96554eaa3971672f05228d26fc6cbe98c8a5b31d35b21c92256c4dfee24ec81a708d601e0be4b80a0a365f620e4b0582f6fcc950f29df2ed6233c8314494ce

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Horse.txt

Ransom Note

::: Hello my dear friend ::: Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them,write to our skype - HORSEMAGYAR DECRYPTION Also you can write ICQ live chat which works 24/7 @HORSEMAGYAR Install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market ICQ Write to our ICQ @HORSEMAGYAR https://icq.im/HORSEMAGYAR If we not reply in 6 hours you can write to our mail but use it only if previous methods not working - [email protected] Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * We are always ready to cooperate and find the best way to solve your problem. * The faster you write, the more favorable the conditions will be for you. * Our company values its reputation. We give all guarantees of your files decryption,such as test decryption some of them We respect your time and waiting for respond from your side tell your MachineID: VFZISKNXTU and LaunchID: 865b452aec Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more...

Emails

[email protected]

URLs

https://icq.com/windows/

https://icq.im/HORSEMAGYAR

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Horse.txt

Ransom Note

::: Hello my dear friend ::: Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them,write to our skype - HORSEMAGYAR DECRYPTION Also you can write ICQ live chat which works 24/7 @HORSEMAGYAR Install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market ICQ Write to our ICQ @HORSEMAGYAR https://icq.im/HORSEMAGYAR If we not reply in 6 hours you can write to our mail but use it only if previous methods not working - [email protected] Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * We are always ready to cooperate and find the best way to solve your problem. * The faster you write, the more favorable the conditions will be for you. * Our company values its reputation. We give all guarantees of your files decryption,such as test decryption some of them We respect your time and waiting for respond from your side tell your MachineID: VEXXSEPUWU and LaunchID: ead01e9ac6 Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more...

Emails

[email protected]

URLs

https://icq.com/windows/

https://icq.im/HORSEMAGYAR

Targets

- Target
  
  z7w3x.exe
- Size
  
  621KB
- MD5
  
  753585e5e099b192cf8d7593dd5ef4bf
- SHA1
  
  68c5d6b38c9dd9e9e1e888386025352811147028
- SHA256
  
  e26b2ffb2ee711fc7b04d62911580560794ee4fa9b7fcfade65ee6ff2eed0274
- SHA512
  
  de96554eaa3971672f05228d26fc6cbe98c8a5b31d35b21c92256c4dfee24ec81a708d601e0be4b80a0a365f620e4b0582f6fcc950f29df2ed6233c8314494ce
Score

10^/10

discovery persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2