adb6f8d52932e656f3b129d4f31104426b39c1c6521e23a59108ee3f7990ba91

General

Target

adb6f8d52932e656f3b129d4f31104426b39c1c6521e23a59108ee3f7990ba91.zip
Size

660KB
Sample

221011-jzeezadecq
MD5

d647220db85f6557e262ada99919e9f2
SHA1

5fceb3f1819a994b22f3f83084ea50e540d9f8e4
SHA256

adb6f8d52932e656f3b129d4f31104426b39c1c6521e23a59108ee3f7990ba91
SHA512

a0cd2e59dbfdf4bb184d148cada7f82e51b5508b9397e460b16b97afe764d789b374ba33d67d9cc730eb74e8db7466fc8af11f6f5fc6eb144f158ac8a07d75d5
SSDEEP

12288:hkr/10xl0PFS4jwbIsO/arlTT6zncVUJ7vndkrL:ar/10xl04EOIH/cTT6DNGrL

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\info.hta

Ransom Note

All your files have been encrypted by Loki locker! All your files have been encrypted due to a security problem with your PC. If you want to restore them, please send an email [email protected] You have to pay for decryption in Bitcoin. The price depends on how fast you contact us. After payment we will send you the decryption tool. You have to 48 hours(2 Days) To contact or paying us After that, you have to Pay Double . In case of no answer in 24 hours (1 Day) write to this email [email protected] Your unique ID is : 1C64CDBA You only have LIMITED time to get back your files! If timer runs out and you dont pay us , all of files will be DELETED and you hard disk will be seriously DAMAGED. You will lose some of your data on day 2 in the timer. You can buy more time for pay. Just email us. THIS IS NOT A JOKE! you can wait for the timer to run out ,and watch deletion of your files :) What is our decryption guarantee? Before paying you can send us up to for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) Attention! DO NOT pay any money before decrypting the test files. DO NOT trust any intermediary. they wont help you and you may be victim of scam. just email us , we help you in any steps. DO NOT reply to other emails. ONLY this two emails can help you. Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  478c116d9bb318b4621c7839c81be36261c38e748a593249f8c9c67789f71064.exe
- Size
  
  660KB
- MD5
  
  affd7cfdd9720f8a044d5e9410923a78
- SHA1
  
  80ac3f86c3a31c4516f9077f8c5e990de2068032
- SHA256
  
  478c116d9bb318b4621c7839c81be36261c38e748a593249f8c9c67789f71064
- SHA512
  
  5468ae683c5d5cf41ae8b961d40a02e827a226a2aa5845c74d20ef0f556145d737d3d8932b0dbae4ff69736c388a931f72a5f33a2775b1a9ac8717ce160b43de
- SSDEEP
  
  12288:1kr/10xl0PFS4jwbIsO/arlTT6zncVUJ7vndkrh:+r/10xl04EOIH/cTT6DNGrh
Score

10^/10

evasion ransomware trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2