zeppelin | 89553444e2b621c1894b6b14023db472f28120ee311adbca8618eaa0106837eb

General

Target

1.exe
Size

214KB
Sample

220926-vpczyacehj
MD5

1175cee6112669df046466d218109fb5
SHA1

25569cd2d388f1e08ee14afd982b236d45d24b76
SHA256

89553444e2b621c1894b6b14023db472f28120ee311adbca8618eaa0106837eb
SHA512

c23c8c9025f1267e55b20c0f42103b556e9323d3e42a1a7f3ad1810565da43f55ca7a96c1cad0740462436c62f1b8392eee1ae90aa9657f3d88aafb27ac75175
SSDEEP

6144:myJE1yd7WHJmcyfjtPWna4DQFu/U3buRKlemZ9DnGAevIhdiFy+:mU/d7WsvBPWa4DQFu/U3buRKlemZ9Dn4

Score

10^/10

zeppelin ransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] 1. Visit https://tox.chat/download.html 2. Download and install qTOX on your PC. 3. Open it, click "New Profile" and create profile. 4. Click "Add friends" button and search our contact - 126E30C4CC9DE90F79D1FA90830FDC2069A2E981ED26B6DC148DA8827FB3D63A1B46CFDEC191 Your personal ID: 80A-1E4-6BC Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

URLs

https://tox.chat/download.html

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] 1. Visit https://tox.chat/download.html 2. Download and install qTOX on your PC. 3. Open it, click "New Profile" and create profile. 4. Click "Add friends" button and search our contact - 126E30C4CC9DE90F79D1FA90830FDC2069A2E981ED26B6DC148DA8827FB3D63A1B46CFDEC191 Your personal ID: 839-154-C75 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

URLs

https://tox.chat/download.html

Targets

- Target
  
  1.exe
- Size
  
  214KB
- MD5
  
  1175cee6112669df046466d218109fb5
- SHA1
  
  25569cd2d388f1e08ee14afd982b236d45d24b76
- SHA256
  
  89553444e2b621c1894b6b14023db472f28120ee311adbca8618eaa0106837eb
- SHA512
  
  c23c8c9025f1267e55b20c0f42103b556e9323d3e42a1a7f3ad1810565da43f55ca7a96c1cad0740462436c62f1b8392eee1ae90aa9657f3d88aafb27ac75175
- SSDEEP
  
  6144:myJE1yd7WHJmcyfjtPWna4DQFu/U3buRKlemZ9DnGAevIhdiFy+:mU/d7WsvBPWa4DQFu/U3buRKlemZ9Dn4
Score

10^/10

ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2