5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087

General

Target

5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087
Size

679KB
Sample

220717-ec1x8sffdn
MD5

cfe5a7469deb3aff3d6630614833afda
SHA1

8d99a9c94bfced8df8f50395e990465d0721e815
SHA256

5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087
SHA512

89fa84f2f5395d5b5a6d263140c7a118d97c8e7d11283f41148dd786f6d16bc583292cec30dbd6e8d9ef3743633fb9adde63e3624a36c9ec89281dfb7603e8ff

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\@@_READ_ME_@@.txt

Ransom Note

$$$$$$$$$$$$$$$$$$$$$$$$> PEEKABOO <$$$$$$$$$$$$$$$$$$$$$$$$ SORRY! Your files are encrypted. File contents are encrypted with random key. Random key is encrypted with RSA public key (2048 bit). We STRONGLY RECOMMEND you NOT to use any "decryption tools". These tools can damage your data, making recover IMPOSSIBLE. Also we recommend you not to contact data recovery companies. They will just contact us, buy the key and sell it to you at a higher price. If you want to decrypt your files, you have to get RSA private key. -- In order to get private key, write here: [email protected] =========== !ATTENTION! Attach file is 000000000.key from %appdata% to email message, without it we will not be able to decrypt your files =========== And pay $300 on BTC-wallet: 1NkjBNF7fmpRsX4WjokUie21m8bv9xvRKs If someone else offers you files restoring, ask him for test decryption. Only we can successfully decrypt your files; knowing this can protect you from fraud. You will receive instructions of what to do next. $$$$$$$$$$$$$$$$$$$$$$$$> PEEKABOO <$$$$$$$$$$$$$$$$$$$$$$$$

Emails

[email protected]

Wallets

1NkjBNF7fmpRsX4WjokUie21m8bv9xvRKs

Targets

- Target
  
  5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087
- Size
  
  679KB
- MD5
  
  cfe5a7469deb3aff3d6630614833afda
- SHA1
  
  8d99a9c94bfced8df8f50395e990465d0721e815
- SHA256
  
  5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087
- SHA512
  
  89fa84f2f5395d5b5a6d263140c7a118d97c8e7d11283f41148dd786f6d16bc583292cec30dbd6e8d9ef3743633fb9adde63e3624a36c9ec89281dfb7603e8ff
Score

10^/10

persistence ransomware
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2