cryptolocker

General

Target

5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9.exe
Size

208KB
Sample

220928-nzkn7sghbn
MD5

12bc78e07cb69dd6ec32729240dbe537
SHA1

7b7d9b115ec10074f7166ec3379fead6e816da59
SHA256

5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9
SHA512

c974592671b081d0af48c1aab9f9f02243773a081d9fadf70e3caa7454dca657b45bece27852397e74f601df1abdf5db496c821a5df624057355fd15c807e15a
SSDEEP

3072:GXbUMNAwQ2Jpo/AkQCUyevi8xRpz81NADJ2:ibUMKwQ2J4ReviSjeKN

Score

10^/10

cryptolocker ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\decrypt_instructions.txt

Ransom Note

Welcome to Wizard Ransomware... Admin, here's what happened... All files are encrypted with Advanced Encryption Standard 256. Maybe you noticed something? Your documents are now unreadable and corrupted. You can wonder how to decrypt it, but... No chance of that, sorry. So, what can you do now? You only have one option to decrypt your files, lets see... If you want your important files back you will need $100 in Bitcoin. However, we are able to discuss this price, maybe we can talk it down, we aren't evil. Want to start the process? You should e-mail us at: [email protected] Include your ID in the e-mail, your ID is: wpVRbZGxJ33o8YtcD7GV41x1q What if I don't pay? Nothing, meaning your files will just be encrypted forever... Bad outcome, right? However, we recommend you be quick, because our operations get shut down fast. Have fun, we're out... Sincerely, Wizard Ransomware.

Emails

[email protected]

Extracted

Path

C:\Users\Admin\Desktop\decrypt_instructions.txt

Ransom Note

Welcome to Wizard Ransomware... Admin, here's what happened... All files are encrypted with Advanced Encryption Standard 256. Maybe you noticed something? Your documents are now unreadable and corrupted. You can wonder how to decrypt it, but... No chance of that, sorry. So, what can you do now? You only have one option to decrypt your files, lets see... If you want your important files back you will need $100 in Bitcoin. However, we are able to discuss this price, maybe we can talk it down, we aren't evil. Want to start the process? You should e-mail us at: [email protected] Include your ID in the e-mail, your ID is: EzYxsCjB6Si75V4V1a3rkWQsN What if I don't pay? Nothing, meaning your files will just be encrypted forever... Bad outcome, right? However, we recommend you be quick, because our operations get shut down fast. Have fun, we're out... Sincerely, Wizard Ransomware.

Emails

[email protected]

Targets

- Target
  
  5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9.exe
- Size
  
  208KB
- MD5
  
  12bc78e07cb69dd6ec32729240dbe537
- SHA1
  
  7b7d9b115ec10074f7166ec3379fead6e816da59
- SHA256
  
  5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9
- SHA512
  
  c974592671b081d0af48c1aab9f9f02243773a081d9fadf70e3caa7454dca657b45bece27852397e74f601df1abdf5db496c821a5df624057355fd15c807e15a
- SSDEEP
  
  3072:GXbUMNAwQ2Jpo/AkQCUyevi8xRpz81NADJ2:ibUMKwQ2J4ReviSjeKN
Score

10^/10

cryptolocker ransomware
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2