0a1688dd2444cbec7c67fae7d0d2745d4b9282e7788623df64b5507f1f7f1b41

General

Target

0a1688dd2444cbec7c67fae7d0d2745d4b9282e7788623df64b5507f1f7f1b41
Size

388KB
Sample

221003-b15dsacdel
MD5

678e01aacc99779c502e9473876548e0
SHA1

cd9e404b37a2029e88f904b98f966b7e1284ff70
SHA256

0a1688dd2444cbec7c67fae7d0d2745d4b9282e7788623df64b5507f1f7f1b41
SHA512

9e37f00ca44f966e3b5c47cd0cdf09cbd960ef961baca64b7fce9a70882e54151c5ddb5d755aef3bf1e3a16a804d90cc4398362440b64ee034a7a1e470b151c4
SSDEEP

6144:fda8uOhcMWhqVln4xKDW9KobFEFLOSO6/NvsHJxc00d+DzRLITiNs:Va8ivhqVl+KC9LpEQSO62DzRLm

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\HELP_RESTORE_FILES.txt

Ransom Note

All your documents, photos, databases and other important files have been encrypted with strongest encryption RSA-2048 key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main encryptor red window, examine it and follow the instructions. Otherwise, it seems that you or your antivirus deleted the encryptor program. Now you have the last chance to decrypt your files. Open http://tkj3higtqlvohs7z.aw49f4j3n26.com or http://tkj3higtqlvohs7z.dfj3d8w3n27.com , https://tkj3higtqlvohs7z.s5.tor-gateways.de/ in your browser. They are public gates to the secret server. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 15fVgKDf3MmS6FzNzRztWWzMcWPXatpVgP Follow the instructions on the server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://tkj3higtqlvohs7z.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 15fVgKDf3MmS6FzNzRztWWzMcWPXatpVgP Follow the instructions on the server.

Wallets

15fVgKDf3MmS6FzNzRztWWzMcWPXatpVgP

URLs

http://tkj3higtqlvohs7z.aw49f4j3n26.com

http://tkj3higtqlvohs7z.dfj3d8w3n27.com

https://tkj3higtqlvohs7z.s5.tor-gateways.de/

http://tkj3higtqlvohs7z.onion/

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\HELP_RESTORE_FILES.txt

Ransom Note

All your documents, photos, databases and other important files have been encrypted with strongest encryption RSA-2048 key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main encryptor red window, examine it and follow the instructions. Otherwise, it seems that you or your antivirus deleted the encryptor program. Now you have the last chance to decrypt your files. Open http://tkj3higtqlvohs7z.aw49f4j3n26.com or http://tkj3higtqlvohs7z.dfj3d8w3n27.com , https://tkj3higtqlvohs7z.s5.tor-gateways.de/ in your browser. They are public gates to the secret server. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 13cDQ5mkTSBazoP4mGFU4SSzZN3LEusayg Follow the instructions on the server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://tkj3higtqlvohs7z.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 13cDQ5mkTSBazoP4mGFU4SSzZN3LEusayg Follow the instructions on the server.

Wallets

13cDQ5mkTSBazoP4mGFU4SSzZN3LEusayg

URLs

http://tkj3higtqlvohs7z.aw49f4j3n26.com

http://tkj3higtqlvohs7z.dfj3d8w3n27.com

https://tkj3higtqlvohs7z.s5.tor-gateways.de/

http://tkj3higtqlvohs7z.onion/

Targets

- Target
  
  0a1688dd2444cbec7c67fae7d0d2745d4b9282e7788623df64b5507f1f7f1b41
- Size
  
  388KB
- MD5
  
  678e01aacc99779c502e9473876548e0
- SHA1
  
  cd9e404b37a2029e88f904b98f966b7e1284ff70
- SHA256
  
  0a1688dd2444cbec7c67fae7d0d2745d4b9282e7788623df64b5507f1f7f1b41
- SHA512
  
  9e37f00ca44f966e3b5c47cd0cdf09cbd960ef961baca64b7fce9a70882e54151c5ddb5d755aef3bf1e3a16a804d90cc4398362440b64ee034a7a1e470b151c4
- SSDEEP
  
  6144:fda8uOhcMWhqVln4xKDW9KobFEFLOSO6/NvsHJxc00d+DzRLITiNs:Va8ivhqVl+KC9LpEQSO62DzRLm
Score

10^/10

persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2