targetcompany | 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6

General

Target

4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6
Size

159KB
Sample

221014-p8nb5adedj
MD5

121ec45315b1cc9d73c9f44fad976694
SHA1

18f1fce2a63883d4eb5e796fc946094dbd948894
SHA256

4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6
SHA512

fa592d7c282d3e726197d6b9207f61fb0cef56e2a3534fbded16269d293af522bc0e93d8107137edb8ffe2ed2ff94357d824ca84c24c8b4c9d6f6696f071170e
SSDEEP

3072:vfCpcDozERHWkC1rd3CC5UB5KvSS0+9Pzo9p04/t9LU5Uht9e8A+BVfRbixpJ+L:vfCpc/RHcQC50e0QPCiEtVvthA7g

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\RECOVERY FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. Do not rename, do not use third-party software or the data will be permanently damaged CONTACT US: [email protected] If first email will not reply in 24 hours then contact with reserve address: [email protected] YOUR PERSONAL ID: F16D28A37EFD In case of non-payment of the ransom, your data may be published in the public domain. Our page in twitter with data leaks: https://twitter.com/mallox_leaks �

Emails

[email protected]

URLs

https://twitter.com/mallox_leaks

Targets

- Target
  
  4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6
- Size
  
  159KB
- MD5
  
  121ec45315b1cc9d73c9f44fad976694
- SHA1
  
  18f1fce2a63883d4eb5e796fc946094dbd948894
- SHA256
  
  4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6
- SHA512
  
  fa592d7c282d3e726197d6b9207f61fb0cef56e2a3534fbded16269d293af522bc0e93d8107137edb8ffe2ed2ff94357d824ca84c24c8b4c9d6f6696f071170e
- SSDEEP
  
  3072:vfCpcDozERHWkC1rd3CC5UB5KvSS0+9Pzo9p04/t9LU5Uht9e8A+BVfRbixpJ+L:vfCpc/RHcQC50e0QPCiEtVvthA7g
Score

10^/10

evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2