targetcompany | 4db69a0643f6ec795e5450a0563605e91293f233aa60715ae09ed8effa3b7267

General

Target

4db69a0643f6ec795e5450a0563605e91293f233aa60715ae09ed8effa3b7267
Size

159KB
Sample

221018-h6bf8aehc5
MD5

14de179afe8e29f828080ad79d523a3f
SHA1

5d56729c8a80c738c05d5e10bb10664c40186c4b
SHA256

4db69a0643f6ec795e5450a0563605e91293f233aa60715ae09ed8effa3b7267
SHA512

fb8ea8c95d1dd6551787528dd2bfeece2543ba0c59347005b63282ed4a5ef6d6c3c8fcdb31af3d409a78d15fef206d637568ae1131521739abfc1b99fd9c3d31
SSDEEP

3072:4ZpcABtMGjkIuuWxCwfKp8vdjwOYvGCbY0oTZRz35cRttX2laYZliyQkV:4ZpcvwNweMwdvTLAZJit9y3V

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\RECOVERY FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. Do not rename, do not use third-party software or the data will be permanently damaged CONTACT US: [email protected] If first email will not reply in 24 hours then contact with reserve address: [email protected] YOUR PERSONAL ID: A514B7427926 In case of non-payment of the ransom, your data may be published in the public domain. Our page in twitter with data leaks: https://twitter.com/mallox_leaks �

Emails

[email protected]

URLs

https://twitter.com/mallox_leaks

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\RECOVERY FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. Do not rename, do not use third-party software or the data will be permanently damaged CONTACT US: [email protected] If first email will not reply in 24 hours then contact with reserve address: [email protected] YOUR PERSONAL ID: D0BFC4345C94 In case of non-payment of the ransom, your data may be published in the public domain. Our page in twitter with data leaks: https://twitter.com/mallox_leaks �

Emails

[email protected]

URLs

https://twitter.com/mallox_leaks

Targets

- Target
  
  4db69a0643f6ec795e5450a0563605e91293f233aa60715ae09ed8effa3b7267
- Size
  
  159KB
- MD5
  
  14de179afe8e29f828080ad79d523a3f
- SHA1
  
  5d56729c8a80c738c05d5e10bb10664c40186c4b
- SHA256
  
  4db69a0643f6ec795e5450a0563605e91293f233aa60715ae09ed8effa3b7267
- SHA512
  
  fb8ea8c95d1dd6551787528dd2bfeece2543ba0c59347005b63282ed4a5ef6d6c3c8fcdb31af3d409a78d15fef206d637568ae1131521739abfc1b99fd9c3d31
- SSDEEP
  
  3072:4ZpcABtMGjkIuuWxCwfKp8vdjwOYvGCbY0oTZRz35cRttX2laYZliyQkV:4ZpcvwNweMwdvTLAZJit9y3V
Score

10^/10

evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2