bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525

General

Target

bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525
Size

685KB
Sample

221123-ln1j6sbh28
MD5

6dcb4ce3ae5aedc4876e9896073c77a5
SHA1

f9153a229d69934d1ec0320f10ef7029b5f38132
SHA256

bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525
SHA512

722357524bd83dc3347a57deb0da06ea06f5ab2a206810e1e40210b035ad7e31d7ac80365ce244de45433e102539fb053990c78a7ac0356f5495b4b80b92f683
SSDEEP

12288:C7jy0J9opbkjyhoHU7ye3Dbfrpfe9HMbIPvHSIVlvee15t+F1D036:C7bJowjyho07zTjtm9R3HTL5t4q6

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DecryptAllFiles 7158839.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. 1. Type the address http://torproject.org in your Internet browser. It opens the Tor site. 2. Press 'Download Tor', then press 'DOWNLOAD Tor Browser Bundle', install and run it.\ 3. Now you have Tor Browser. In the Tor Browser open the http://zt6bycgnjvatzzvi.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. 4. Copy and paste the following public key in the input form on server. Avoid missprints. RIXY2M-RZZZ6W-WQ7AQG-D3LPTZ-6ZCZU6-WEHJFB-3PL3AC-WRB7YH Q5UGUK-JY64UY-NXWCNQ-LTSOXC-MOFJYY-BPRTCN-OYGXQ4-RHBCM5 WVXYC3-3Y7QLA-ELUYP5-SVZMID-OMPCIM-HSVMYG-LGTTUM-ZCG55H 5. Follow the instructions on the server.

URLs

http://zt6bycgnjvatzzvi.onion

Targets

- Target
  
  bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525
- Size
  
  685KB
- MD5
  
  6dcb4ce3ae5aedc4876e9896073c77a5
- SHA1
  
  f9153a229d69934d1ec0320f10ef7029b5f38132
- SHA256
  
  bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525
- SHA512
  
  722357524bd83dc3347a57deb0da06ea06f5ab2a206810e1e40210b035ad7e31d7ac80365ce244de45433e102539fb053990c78a7ac0356f5495b4b80b92f683
- SSDEEP
  
  12288:C7jy0J9opbkjyhoHU7ye3Dbfrpfe9HMbIPvHSIVlvee15t+F1D036:C7bJowjyho07zTjtm9R3HTL5t4q6
Score

10^/10

ransomware spyware stealer
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2