General
- Target 2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
- Size 159KB
- Sample221022-csjb1sabc4
- SHA256 2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
Score
10/10
Malware Config
Extracted
Path
-
C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\RECOVERY FILES.txt
Ransom Note
- YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. Do not rename, do not use third-party software or the data will be permanently damaged CONTACT US: [email protected] If first email will not reply in 24 hours then contact with reserve address: [email protected] YOUR PERSONAL ID: 4F6BC6F3DD3D In case of non-payment of the ransom, your data may be published in the public domain. Our page in twitter with data leaks: https://twitter.com/mallox_leaks �
URLs
-
https://twitter.com/mallox_leaks
Targets
-
- Target 2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
- Size 159KB
- SHA256 2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.