General
- Target f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.zip
- Size 112KB
- Sample220708-l97klsdfh3
- SHA256 ec704de00a60797b2ecc3be32cf7a58ed5d681a2c07e39c26f1302d243aa49cf
Score
10/10
Malware Config
Extracted
Path
-
C:\Restore_Your_Files.txt
Ransom Note
- All your important files have been encrypted and stolen! Contact us for price and get decryption software. You have 3 days to contact us for negotiation. If you don't contact within three days, we'll start leaking data. 1) Contact our tox. Tox download address: https://tox.chat/ Our poison ID: 59B542C61F574BD8B3255E55651FC7C49EB53546FC6AD0698C7A12D97D193C7D6DBA9758A282 * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open : http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion
URLs
-
https://tox.chat/
-
http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion
Targets
-
- Target f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe
- Size 235KB
- SHA256 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.