targetcompany | a5085e571857ec54cf9625050dfc29a195dad4d52bea9b69d3f22e33ed636525

General

Target

a5085e571857ec54cf9625050dfc29a195dad4d52bea9b69d3f22e33ed636525
Size

159KB
Sample

221018-t6nbkagea6
MD5

be971d880e75cd48a669ea9e45f6f022
SHA1

43b24f5108ff16c56e836082da80128fe516d8af
SHA256

a5085e571857ec54cf9625050dfc29a195dad4d52bea9b69d3f22e33ed636525
SHA512

ded17b8af07b1035d74cbbfeb218c88d12210c047458d4261352613dda693d88259244ad345abef09b016515fe497c49fab944937939a2063ca5249aeb82b064
SSDEEP

3072:o3ypcDozZR/WcCF7dPiyJUh5KvdtEZtPz4g0I/t9L05Uht9uew+BVfRUi29J+L:o3ypcmR/UoyJU8EPPE0tVPtnNgg

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\RECOVERY FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. Do not rename, do not use third-party software or the data will be permanently damaged CONTACT US: [email protected] If first email will not reply in 24 hours then contact with reserve address: [email protected] YOUR PERSONAL ID: EACF8F995F77 In case of non-payment of the ransom, your data may be published in the public domain. Our page in telegram with data leaks: https://t.me/mallox_leaks �

Emails

[email protected]

URLs

https://t.me/mallox_leaks

Targets

- Target
  
  a5085e571857ec54cf9625050dfc29a195dad4d52bea9b69d3f22e33ed636525
- Size
  
  159KB
- MD5
  
  be971d880e75cd48a669ea9e45f6f022
- SHA1
  
  43b24f5108ff16c56e836082da80128fe516d8af
- SHA256
  
  a5085e571857ec54cf9625050dfc29a195dad4d52bea9b69d3f22e33ed636525
- SHA512
  
  ded17b8af07b1035d74cbbfeb218c88d12210c047458d4261352613dda693d88259244ad345abef09b016515fe497c49fab944937939a2063ca5249aeb82b064
- SSDEEP
  
  3072:o3ypcDozZR/WcCF7dPiyJUh5KvdtEZtPz4g0I/t9L05Uht9uew+BVfRUi29J+L:o3ypcmR/UoyJU8EPPE0tVPtnNgg
Score

10^/10

evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2