4454a3c56660eba7ebbad67fbf04018b17ccc8ed16ef93ac8cc60a86dbf39ae0

General

Target

4454a3c56660eba7ebbad67fbf04018b17ccc8ed16ef93ac8cc60a86dbf39ae0
Size

27KB
Sample

221019-hz1grsehh9
MD5

e94eed86a5492c7e00da42c0a2463935
SHA1

d2eac440766ffaeb83d567d525583727d1faf163
SHA256

4454a3c56660eba7ebbad67fbf04018b17ccc8ed16ef93ac8cc60a86dbf39ae0
SHA512

cdd815827bae7e655ee2c19fce89f919eea6e32bcde1acca8927280684a96d0b5fd1bd35cf033bd828e4dcb05d804fe970edcf825c309117485484b2ea078f86
SSDEEP

384:4JC/8iqrKZgU6uMKJNakkTiHG8eZXVb0/ze29j1W4TvU:iCUiq4NyVb0/zt3M

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Links\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note

Oops All Of your important files were encrypted Like document pictures videos etc.. Don't worry, you can return all your files! All your files, documents, photos, databases and other important files are encrypted by a strong encryption. How to recover files? RSA is a asymmetric cryptographic algorithm, you need one key for encryption and one key for decryption so you need private key to recover your files. It’s not possible to recover your files without private key. The only method of recovering files is to purchase an unique private key.Only we can give you this key and only we can recover your files. What guarantees you have? As evidence, you can send us 1 file to decrypt by email We will send you a recovery file Prove that we can decrypt your file Please You must follow these steps carefully to decrypt your files: Send $980 worth of bitcoin to wallet: bc1qzpa3j6qse5xfxft2xy7h2phq04wq9pk66lllz5 after payment,we will send you Decryptor software contact email: [email protected] Your personal ID: U8neUFRJrlOPir+l8w/I896I4+xN12SgsJbQIxt6e22wsgmEh/DI1QJd1Gt+RM8klS1JEkA37MI/qmbcutDgdxEbp/xg6UMcY+vZKK0/LQp1NXuDw0yWbPDPHRBEg33aE5Q6dCSIl7TrUC2BOFez9F9FbyDHeDU/MMrR8HVdGDs=

Emails

[email protected]

Extracted

Path

C:\Users\Admin\Links\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note

Oops All Of your important files were encrypted Like document pictures videos etc.. Don't worry, you can return all your files! All your files, documents, photos, databases and other important files are encrypted by a strong encryption. How to recover files? RSA is a asymmetric cryptographic algorithm, you need one key for encryption and one key for decryption so you need private key to recover your files. It’s not possible to recover your files without private key. The only method of recovering files is to purchase an unique private key.Only we can give you this key and only we can recover your files. What guarantees you have? As evidence, you can send us 1 file to decrypt by email We will send you a recovery file Prove that we can decrypt your file Please You must follow these steps carefully to decrypt your files: Send $980 worth of bitcoin to wallet: bc1qzpa3j6qse5xfxft2xy7h2phq04wq9pk66lllz5 after payment,we will send you Decryptor software contact email: [email protected] Your personal ID: feCEulevw48BVagzJetAbdzSVlJtiYgo3j1N0htZiKwwZviSyEYe1CJsn01vaEwaNxFcuXstcnDt3crT2yaN+sO6LXObM4PrQS7Y7C5IK8mFq9LI7KUmRbfwK+HUWfZBIUz7+OVNyYphYaUqXbg9l3lm8vZBkIjTM8v5YUtQekw=

Emails

[email protected]

Targets

- Target
  
  5fef2acf0b0289500ddfcbcbe45c95973c37d30eecdb2f5f20894a5f5b43ef31.exe
- Size
  
  27KB
- MD5
  
  f6d05f1f65b85eb1228f6524bb3773e8
- SHA1
  
  2c1a3b5de5d9e34e20fcf39671b4359abd38507c
- SHA256
  
  5fef2acf0b0289500ddfcbcbe45c95973c37d30eecdb2f5f20894a5f5b43ef31
- SHA512
  
  b8365ac6ef36e8bf133797533cae01b0c1a9646fa87949d28235553e51f7cec3c6ebf77c9eb0764fc43c5e47283e9c579b2b16308adb191cba83ef26cbfa84e5
- SSDEEP
  
  384:+JC/8iqrKZgU6uMKJNakkTiHG8eZXVb0/ze29j1W4Tv:oCUiq4NyVb0/zt3
Score

10^/10

evasion ransomware trojan persistence
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2