General

  • Target

    HEUR-Trojan-Ransom.MSIL.Agent.gen-ecf1633a5b162a9e59e76e8dd86afde28e32cc3be2e454188cd5e063e6be3650.exe

  • Size

    8KB

  • Sample

    220924-lm7xvsbaa3

  • MD5

    8afc6df4f14d30c0eb7fe9af68ede7de

  • SHA1

    c8a5d2aa3bc022b403035e909efa22df347dabe2

  • SHA256

    ecf1633a5b162a9e59e76e8dd86afde28e32cc3be2e454188cd5e063e6be3650

  • SHA512

    05679182c9a6c0358f8eb981cd4b76f08c56ecef0ca3a4a9c1c327c5d3f21be47046bc2c5dbe7fdce99b312a912b57246325e51bd31e85c3f9918b40ef1567d5

  • SSDEEP

    96:KUZk1ypMIPOXeZVBoNypU0PeP8KRHPuYf7oP:Fu1y6IPUeZDoz86HLs

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\FILES ENCRYPTED.TXT

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail supportdata@cock.li Write this ID in the title of your message 1E192D2A In case of no answer in 24 hours write us to theese e-mails:xmmh@tutanota.com You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: How Can I Buy Bitcoin? Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

supportdata@cock.li

e-mails:xmmh@tutanota.com

Targets

    • Target

      HEUR-Trojan-Ransom.MSIL.Agent.gen-ecf1633a5b162a9e59e76e8dd86afde28e32cc3be2e454188cd5e063e6be3650.exe

    • Size

      8KB

    • MD5

      8afc6df4f14d30c0eb7fe9af68ede7de

    • SHA1

      c8a5d2aa3bc022b403035e909efa22df347dabe2

    • SHA256

      ecf1633a5b162a9e59e76e8dd86afde28e32cc3be2e454188cd5e063e6be3650

    • SHA512

      05679182c9a6c0358f8eb981cd4b76f08c56ecef0ca3a4a9c1c327c5d3f21be47046bc2c5dbe7fdce99b312a912b57246325e51bd31e85c3f9918b40ef1567d5

    • SSDEEP

      96:KUZk1ypMIPOXeZVBoNypU0PeP8KRHPuYf7oP:Fu1y6IPUeZDoz86HLs

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks