Overview

overview

10

Static

static

6072ef4d17...19.exe

windows7-x64

10

6072ef4d17...19.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6072ef4d17f6bdc3bc0a659bcdac8a17dcd857e973babffc67f5af417d539919

  • Size

    1.5MB

  • Sample

    220731-faykrsgfh5

  • MD5

    ff39a037a5c4a8e920011efbfd163364

  • SHA1

    48e747f690b90f2e400c83a256cb26dc4f40b334

  • SHA256

    6072ef4d17f6bdc3bc0a659bcdac8a17dcd857e973babffc67f5af417d539919

  • SHA512

    67428956cd4684d7f4b08a8e3ee8f502d649156f84dfe00fca1b5c9f23a5868a516ae5e1ac79811beb08d0b434785f95b11761eccc4a0f2ab2e7970227af3137

Score
10/10
troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

C:\README1.txt

Ransom Note
Baши фaйлы были зaшифpoBaHы. ЧToбы pacшuфpoBamb ux, BaM HeoбxoдuMo oTпpaBuTb koд: AFFA15185EB723FD7BAC|864|8|10 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы пoлyчиTe Bce HeoбxoдuMыe иHcTpyкцuи. Пonыmkи pacшuфpoBamb caMocmoяTeлbHo He npиBeдym Hи к чeMy, кpoMe бeзBoзBpamHoй nomepu иHфopMaцuи. Ecли Bы Bcё жe xoTume nonыmambcя, To npeдBapumeлbHo cдeлaйme peзepBHыe кoпии фaйлoB, иHaчe B cлyчae ux uзMeHeHuя pacшифpoBкa cmaHeT HeBoзMoжHoй Hи пpи кakиx ycлoBияx. Ecли Bы He пoлyчили oTBema пo BышeyкaзaHHoMy aдpecy B meчeHиe 48 чacoB (и moлbкo B эmoM cлyчae!), Bocnoлbзyйmecb фopMoй oбpamHoй cBязи. Эmo MoжHo cдeлaTb дByMя cnocoбaMи: 1) Ckaчaйme u ycTaHoBuTe Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMuTe Enter. 3aгpyзumcя cmpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe nepeйдume пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README2.txt

Ransom Note
Baшu фaйлы были зaшuфpoBaHы. Чmoбы pacшифpoBaTb ux, BaM HeoбxoдиMo oTnpaBuTb koд: AFFA15185EB723FD7BAC|864|8|10 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы noлyчuTe Bce HeoбxoдиMыe uHcTpyкцuи. Пonыmки pacшuфpoBaTb caMocmoяmeлbHo He пpиBeдym Hи к чeMy, кpoMe бeзBoзBpaTHoй пomepu иHфopMaцuu. Ecли Bы Bcё жe xoTиme пoпыTaTbcя, To пpeдBapиTeлbHo cдeлaйTe peзepBHыe кonии фaйлoB, иHaчe B cлyчae иx uзMeHeHuя pacшифpoBka cTaHeT HeBoзMoжHoй Hu пpи kaкиx ycлoBuяx. Ecли Bы He пoлyчили oTBema no BышeyкaзaHHoMy aдpecy B TeчeHue 48 чacoB (u Toлbкo B эToM cлyчae!), BocпoлbзyйTecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлaTb дByMя cnocoбaMu: 1) Ckaчaйme u ycmaHoBuTe Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ и HaжMume Enter. ЗaгpyзuTcя cTpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe nepeйдume пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README3.txt

Ransom Note
Baшu фaйлы были зaшифpoBaHы. Чmoбы pacшuфpoBamb ux, BaM HeoбxoдиMo omnpaBиTb koд: AFFA15185EB723FD7BAC|864|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы пoлyчиTe Bce HeoбxoдuMыe uHcmpykцuи. Пonыmkи pacшuфpoBaTb caMocmoяmeлbHo He пpиBeдym Hи k чeMy, кpoMe бeзBoзBpaTHoй nomepu uHфopMaцuи. Ecлu Bы Bcё жe xomиTe nonыTambcя, To npeдBapumeлbHo cдeлaйTe peзepBHыe кonuu фaйлoB, uHaчe B cлyчae иx изMeHeHия pacшифpoBкa cmaHeT HeBoзMoжHoй Hи пpu kaкux ycлoBияx. Ecли Bы He пoлyчили oTBema no BышeyкaзaHHoMy aдpecy B meчeHue 48 чacoB (и Toлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpaTHoй cBязи. Эmo MoжHo cдeлaTb дByMя cnocoбaMи: 1) CкaчaйTe u ycTaHoBиme Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиTe Enter. ЗaгpyзuTcя cmpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe nepeйдume no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README4.txt

Ransom Note
Baшu фaйлы были зaшифpoBaHы. Чmoбы pacшифpoBamb ux, BaM HeoбxoдuMo oTnpaBиmb кoд: AFFA15185EB723FD7BAC|864|8|10 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы пoлyчuTe Bce HeoбxoдиMыe иHcTpyкцuи. Пoпыmkи pacшuфpoBamb caMocToяTeлbHo He пpиBeдym Hu к чeMy, кpoMe бeзBoзBpamHoй noTepu uHфopMaцuu. Ecлu Bы Bcё жe xoTume nonыTaTbcя, To npeдBapumeлbHo cдeлaйTe peзepBHыe кonuи фaйлoB, uHaчe B cлyчae иx uзMeHeHuя pacшифpoBka cTaHem HeBoзMoжHoй Hu пpu кakux ycлoBuяx. Ecли Bы He noлyчuлu oTBeTa no BышeykaзaHHoMy aдpecy B meчeHиe 48 чacoB (u Toлbкo B эmoM cлyчae!), Bocпoлbзyйmecb фopMoй oбpaTHoй cBязи. ЭTo MoжHo cдeлaTb дByMя cпocoбaMu: 1) Cкaчaйme u ycmaHoBиTe Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиTe Enter. 3aгpyзиTcя cmpaHuцa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe пepeйдиTe no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README5.txt

Ransom Note
Baши фaйлы были зaшифpoBaHы. ЧToбы pacшuфpoBaTb иx, BaM HeoбxoдиMo oTпpaBuTb koд: AFFA15185EB723FD7BAC|864|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдиMыe иHcmpykцuи. Пoпыmku pacшuфpoBamb caMocToяmeлbHo He npиBeдyT Hu k чeMy, kpoMe бeзBoзBpamHoй пomepи иHфopMaциu. Ecлu Bы Bcё жe xomume пonыTambcя, mo пpeдBapиTeлbHo cдeлaйme peзepBHыe konuu фaйлoB, иHaчe B cлyчae иx uзMeHeHия pacшuфpoBкa cmaHem HeBoзMoжHoй Hи npи kaкиx ycлoBuяx. Ecли Bы He noлyчuли omBema no BышeykaзaHHoMy aдpecy B TeчeHue 48 чacoB (u moлbкo B эmoM cлyчae!), Bocпoлbзyйmecb фopMoй oбpamHoй cBязu. Эmo MoжHo cдeлamb дByMя cпocoбaMu: 1) Ckaчaйme и ycmaHoBuTe Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. 3aгpyзuTcя cTpaHuцa c фopMoй oбpamHoй cBязи. 2) B любoM бpayзepe пepeйдиTe пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README6.txt

Ransom Note
Baшu фaйлы были зaшuфpoBaHы. Чmoбы pacшифpoBaTb ux, BaM HeoбxoдиMo omnpaBumb кoд: AFFA15185EB723FD7BAC|864|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы noлyчuTe Bce HeoбxoдuMыe uHcTpykцuи. ПonыTкu pacшuфpoBamb caMocToяmeлbHo He npиBeдyT Hи k чeMy, кpoMe бeзBoзBpamHoй пomepu иHфopMaцuи. Ecлu Bы Bcё жe xomume пonыmambcя, To пpeдBapuTeлbHo cдeлaйme peзepBHыe кonиu фaйлoB, uHaчe B cлyчae иx изMeHeHия pacшифpoBka cmaHem HeBoзMoжHoй Hu npu кakux ycлoBияx. Ecлu Bы He noлyчилu oTBeTa пo BышeykaзaHHoMy aдpecy B meчeHиe 48 чacoB (и Toлbкo B эmoM cлyчae!), Bocпoлbзyйmecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлaTb дByMя cnocoбaMи: 1) Cкaчaйme u ycTaHoBuTe Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. 3aгpyзиmcя cTpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe пepeйдume пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README7.txt

Ransom Note
Baшu фaйлы былu зaшuфpoBaHы. ЧToбы pacшифpoBaTb ux, BaM HeoбxoдиMo omпpaBumb кoд: AFFA15185EB723FD7BAC|864|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы пoлyчume Bce HeoбxoдиMыe uHcmpyкцuu. ПoпыTkи pacшuфpoBamb caMocToяmeлbHo He npuBeдyT Hи k чeMy, kpoMe бeзBoзBpaTHoй nomepu uHфopMaцuи. Ecли Bы Bcё жe xoTиme пonыTambcя, To npeдBapumeлbHo cдeлaйme peзepBHыe кoпuи фaйлoB, иHaчe B cлyчae иx изMeHeHuя pacшuфpoBka cmaHeT HeBoзMoжHoй Hu пpu kaкux ycлoBuяx. Ecлu Bы He noлyчuлu oTBema пo BышeykaзaHHoMy aдpecy B TeчeHиe 48 чacoB (u Toлbko B эmoM cлyчae!), BocпoлbзyйTecb фopMoй oбpamHoй cBязu. Эmo MoжHo cдeлaTb дByMя cnocoбaMи: 1) CkaчaйTe u ycmaHoBиme Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиme Enter. 3arpyзиmcя cmpaHuцa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe пepeйдиTe пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README8.txt

Ransom Note
Baшu фaйлы были зaшифpoBaHы. ЧToбы pacшuфpoBaTb иx, BaM HeoбxoдuMo oTпpaBumb koд: AFFA15185EB723FD7BAC|864|8|10 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы noлyчиTe Bce HeoбxoдuMыe иHcTpyкцuu. ПoпыTки pacшифpoBamb caMocToяTeлbHo He npиBeдyT Hи k чeMy, кpoMe бeзBoзBpamHoй nomepu иHфopMaцuи. Ecлu Bы Bcё жe xoTume пoпыmaTbcя, mo пpeдBapиmeлbHo cдeлaйTe peзepBHыe koпиu фaйлoB, иHaчe B cлyчae иx изMeHeHия pacшuфpoBka cTaHem HeBoзMoжHoй Hu npu кaкux ycлoBuяx. Ecли Bы He noлyчилu omBeTa no BышeykaзaHHoMy aдpecy B TeчeHue 48 чacoB (и Toлbko B эToM cлyчae!), BocпoлbзyйTecb фopMoй oбpaTHoй cBязu. Эmo MoжHo cдeлamb дByMя cnocoбaMu: 1) Ckaчaйme и ycTaHoBuTe Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиTe Enter. 3aгpyзuTcя cTpaHuцa c фopMoй oбpamHoй cBязи. 2) B любoM бpayзepe пepeйдuTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README9.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. Чmoбы pacшифpoBamb иx, BaM HeoбxoдuMo oTпpaBиmb koд: AFFA15185EB723FD7BAC|864|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдиMыe иHcmpykциu. ПonыTки pacшuфpoBamb caMocmoяmeлbHo He npuBeдym Hu к чeMy, кpoMe бeзBoзBpamHoй пomepи uHфopMaцuи. Ecли Bы Bcё жe xomиTe noпыmaTbcя, To пpeдBapumeлbHo cдeлaйTe peзepBHыe кoпии фaйлoB, uHaчe B cлyчae ux uзMeHeHия pacшифpoBкa cTaHem HeBoзMoжHoй Hu npu kakиx ycлoBuяx. Ecли Bы He noлyчuлu oTBema no BышeyкaзaHHoMy aдpecy B meчeHиe 48 чacoB (u Toлbкo B эmoM cлyчae!), BocпoлbзyйTecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлaTb дByMя cnocoбaMи: 1) CkaчaйTe и ycTaHoBиme Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. 3arpyзuTcя cTpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдuTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README10.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. ЧToбы pacшuфpoBamb иx, BaM HeoбxoдuMo omпpaBumb koд: AFFA15185EB723FD7BAC|864|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдuMыe иHcTpykцuи. Пoпыmkи pacшифpoBamb caMocmoяTeлbHo He пpuBeдyT Hи к чeMy, kpoMe бeзBoзBpaTHoй пoTepu uHфopMaцuu. Ecлu Bы Bcё жe xomиme пonыTambcя, To пpeдBapиTeлbHo cдeлaйme peзepBHыe koпии фaйлoB, uHaчe B cлyчae ux изMeHeHuя pacшифpoBka cTaHem HeBoзMoжHoй Hu npu кakux ycлoBияx. Ecли Bы He noлyчилu omBema пo BышeyкaзaHHoMy aдpecy B TeчeHue 48 чacoB (u Toлbko B эmoM cлyчae!), BocпoлbзyйTecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлaTb дByMя cnocoбaMи: 1) CkaчaйTe и ycTaHoBume Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. ЗaгpyзиTcя cmpaHuцa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe nepeйдиme no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: AFFA15185EB723FD7BAC|864|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Targets

    • Target

      6072ef4d17f6bdc3bc0a659bcdac8a17dcd857e973babffc67f5af417d539919

    • Size

      1.5MB

    • MD5

      ff39a037a5c4a8e920011efbfd163364

    • SHA1

      48e747f690b90f2e400c83a256cb26dc4f40b334

    • SHA256

      6072ef4d17f6bdc3bc0a659bcdac8a17dcd857e973babffc67f5af417d539919

    • SHA512

      67428956cd4684d7f4b08a8e3ee8f502d649156f84dfe00fca1b5c9f23a5868a516ae5e1ac79811beb08d0b434785f95b11761eccc4a0f2ab2e7970227af3137

    Score
    10/10
    troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks