cryptolocker

General

Target

Company Schedules New - Image Slideshow.bin.zip
Size

77KB
Sample

221009-v63lxshdb6
MD5

c8416e1466e48957813d8b271f0a3f3b
SHA1

227df9d04d308770c73991ca08e11226ad2fea71
SHA256

bd2b881e8f1cd1bde16f910afaaa58b53128fca3e84b901126b5abb12b023289
SHA512

67244788614c4189c6d379cec96acfa1b0338bbdf0f5973ee1daa55d5263e40f06c925574803fe1497b96b079142b65e82ba1e2c43d038c629806735f8908d55
SSDEEP

1536:LJ1Vqg2DXDXoiXJkrtMYiMDKfZg3tinMOmMyTWfCQj33dHVBBE:TViXDYwwMYiq4Zg3toYM2WfJDBm

Score

10^/10

cryptolocker ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\decrypt_instructions.txt

Ransom Note

Welcome to Wizard Ransomware... Admin, here's what happened... All files are encrypted with Advanced Encryption Standard 256. Maybe you noticed something? Your documents are now unreadable and corrupted. You can wonder how to decrypt it, but... No chance of that, sorry. So, what can you do now? You only have one option to decrypt your files, lets see... If you want your important files back you will need $100 in Bitcoin. However, we are able to discuss this price, maybe we can talk it down, we aren't evil. Want to start the process? You should e-mail us at: [email protected] Include your ID in the e-mail, your ID is: PIzQjWdOA8X2k4InjwICYYyor What if I don't pay? Nothing, meaning your files will just be encrypted forever... Bad outcome, right? However, we recommend you be quick, because our operations get shut down fast. Have fun, we're out... Sincerely, Wizard Ransomware.

Emails

[email protected]

Extracted

Path

C:\Users\Admin\Desktop\decrypt_instructions.txt

Ransom Note

Welcome to Wizard Ransomware... Admin, here's what happened... All files are encrypted with Advanced Encryption Standard 256. Maybe you noticed something? Your documents are now unreadable and corrupted. You can wonder how to decrypt it, but... No chance of that, sorry. So, what can you do now? You only have one option to decrypt your files, lets see... If you want your important files back you will need $100 in Bitcoin. However, we are able to discuss this price, maybe we can talk it down, we aren't evil. Want to start the process? You should e-mail us at: [email protected] Include your ID in the e-mail, your ID is: ApNNYyGCRCbx2PstwMd0c8ZsC What if I don't pay? Nothing, meaning your files will just be encrypted forever... Bad outcome, right? However, we recommend you be quick, because our operations get shut down fast. Have fun, we're out... Sincerely, Wizard Ransomware.

Emails

[email protected]

Targets

- Target
  
  Company Schedules New - Image Slideshow.bin
- Size
  
  208KB
- MD5
  
  12bc78e07cb69dd6ec32729240dbe537
- SHA1
  
  7b7d9b115ec10074f7166ec3379fead6e816da59
- SHA256
  
  5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9
- SHA512
  
  c974592671b081d0af48c1aab9f9f02243773a081d9fadf70e3caa7454dca657b45bece27852397e74f601df1abdf5db496c821a5df624057355fd15c807e15a
- SSDEEP
  
  3072:GXbUMNAwQ2Jpo/AkQCUyevi8xRpz81NADJ2:ibUMKwQ2J4ReviSjeKN
Score

10^/10

cryptolocker ransomware
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2