General
- Target c37e36a539eebaa8bfe5b646690c478367a49059900fbd7ab9e552076d480bed
- Size 204KB
- Sample221013-vdcvssdhaq
- SHA256 c37e36a539eebaa8bfe5b646690c478367a49059900fbd7ab9e552076d480bed
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\Lang\DECRYPT_INSTRUCTION.html
Ransom Note
- <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b>
Targets
-
- Target c37e36a539eebaa8bfe5b646690c478367a49059900fbd7ab9e552076d480bed
- Size 204KB
- SHA256 c37e36a539eebaa8bfe5b646690c478367a49059900fbd7ab9e552076d480bed
Score10/10-
CryptoWall
Ransomware family which is an improved version of the older CryptoDefense.
-
Drops file in Drivers directory
-
Drops desktop.ini file(s)
-
Drops file in System32 directory