targetcompany | 2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd

General

Target

2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
Size

159KB
Sample

221022-csjb1sabc4
MD5

ddce5db099bab8bc56d5ac70d83842a0
SHA1

7cd97f3e7a64cf10727ffff9634b9f2f0ed69c9d
SHA256

2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
SHA512

859801169bd7f26f6918ecea0aee1c9473ac25dc74c861642efd428f6c2d3644d5f64d7113da1d96120b8eca4ee0dcfb26f082c2c8d1a63a8252713ab3fb9c23
SSDEEP

3072:HfCpcDozERHWkC1rd3CC5UB5KvSS0+9Pzo9p04/t9LU5Uht9e8A+BVfRbixvJ+L:HfCpc/RHcQC50e0QPCiEtVvthAJg

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\RECOVERY FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. Do not rename, do not use third-party software or the data will be permanently damaged CONTACT US: [email protected] If first email will not reply in 24 hours then contact with reserve address: [email protected] YOUR PERSONAL ID: 4F6BC6F3DD3D In case of non-payment of the ransom, your data may be published in the public domain. Our page in twitter with data leaks: https://twitter.com/mallox_leaks �

Emails

[email protected]

URLs

https://twitter.com/mallox_leaks

Targets

- Target
  
  2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
- Size
  
  159KB
- MD5
  
  ddce5db099bab8bc56d5ac70d83842a0
- SHA1
  
  7cd97f3e7a64cf10727ffff9634b9f2f0ed69c9d
- SHA256
  
  2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
- SHA512
  
  859801169bd7f26f6918ecea0aee1c9473ac25dc74c861642efd428f6c2d3644d5f64d7113da1d96120b8eca4ee0dcfb26f082c2c8d1a63a8252713ab3fb9c23
- SSDEEP
  
  3072:HfCpcDozERHWkC1rd3CC5UB5KvSS0+9Pzo9p04/t9LU5Uht9e8A+BVfRbixvJ+L:HfCpc/RHcQC50e0QPCiEtVvthAJg
Score

10^/10

evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2