General
- Target 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.sample
- Size 71KB
- Sample220628-ppntjshddq
- SHA256 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb
Score
10/10
Malware Config
Extracted
Path
-
C:\msocache\# DECRYPT FILES BLUESKY #.txt
Ransom Note
- <<< B L U E S K Y >>> YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: -------------------------------------------------------------- 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the tor browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions --------------------------------------------------------------
URLs
-
http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion
Extracted
Path
-
C:\msocache\# DECRYPT FILES BLUESKY #.html
Ransom Note
- <!DOCTYPE html> <html> <body> <center> <font size = "6"> <p><b>B L U E S K Y</b></p> <font size = "4"> <p><b>YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED!</b></p> <p>The only way to decrypt and restore your files is with our private key and program.</p> <p>Any attempts to restore your files manually will damage your files.</p> <br> <p>To restore your files follow these instructions:</p> <p><b>1. Download and install "Tor Browser" from https://torproject.org/</p> <p>2. Run "Tor Browser"</p> <p>3. In the Tor Browser open website:</p> <p></b>http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion</p> <p><b>4. On the website enter your recovery id:</p> <p></b>RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047</p> <p><b>5. Follow the instructions on the website</b></p> </center> </body> </html>
Extracted
Path
-
C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html
Ransom Note
- B L U E S K Y YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the Tor Browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions on the website
URLs
-
http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion
Targets
-
- Target 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.sample
- Size 71KB
- SHA256 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Suspicious use of NtSetInformationThreadHideFromDebugger