targetcompany | 40333778efd4cdde89fe2c4adc1066f418421e0ea26abdfcc4a5ce3e79436b27

General

Target

8e974a3be94b7748f7971f278160a74d738d5cab2c3088b1492cfbbd05e83e22.zip
Size

88KB
Sample

221009-vex75ahdfq
MD5

87b7f560df2bebd79b95ffd9f093ec6e
SHA1

b7bcca9a12bb1fe6e3a595d9c76555a18c8331bc
SHA256

40333778efd4cdde89fe2c4adc1066f418421e0ea26abdfcc4a5ce3e79436b27
SHA512

753e3dd5d47cd56126dfe96ed13cf970f88c5994d525a6f0bf3ab41ee35732af740c2f41c095a5e210d71cd3c7ed40f5ca8ca8e0d8245e102032557608728aaf
SSDEEP

1536:7UeA6hcU7m3ja9g2xAUsB2vI52/O67cHTPCrLzwIzRkLJc9lAXOtCAerEQN:7Ue/hT2a9g2xAHz4OnTPWHw+udc9lAHJ

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\RECOVERY FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. Do not rename, do not use third-party software or the data will be permanently damaged CONTACT US: [email protected] If first email will not reply in 24 hours then contact with reserve address: [email protected] YOUR PERSONAL ID: E7281A596504 In case of non-payment of the ransom, your data may be published in the public domain. Our page in telegram with data leaks: https://t.me/mallox_leaks �

Emails

[email protected]

URLs

https://t.me/mallox_leaks

Targets

- Target
  
  8e974a3be94b7748f7971f278160a74d738d5cab2c3088b1492cfbbd05e83e22
- Size
  
  159KB
- MD5
  
  ecc918fd6e040ba4675c3179f05da459
- SHA1
  
  b372124021c93ffc52e43a7af0883e880d4eb730
- SHA256
  
  8e974a3be94b7748f7971f278160a74d738d5cab2c3088b1492cfbbd05e83e22
- SHA512
  
  840b668cbad5897b5f52fe4ef86069b6668f49299a5b2bba24290d7df7b7db36f8ef4ee89644134d61930da647a235b38af2ebe79e772c547a8ba5b05ba08cad
- SSDEEP
  
  3072:X3ypcDozZR/WcCF7dPiyJUh5KvdtEZtPz4g0I/t9L05Uht9uew+BVfRUi6BJ+L:X3ypcmR/UoyJU8EPPE0tVPtnNgg
Score

10^/10

evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2