General
-
Target
M.exe
-
Size
311KB
-
Sample
221125-c4fehaaa8s
-
MD5
afddf1db7b4dd2928105e34d2e3e7054
-
SHA1
bba5a0c24a06abc2edc79bd1432b74f217a9da25
-
SHA256
48046fb0e566f5a2d184f84b76d6cadc458762556daed0ae4a3a1200afbefb54
-
SHA512
2f1aa2fd2c1b2189889c7a0eb90c3f9b5a278b5ed11964927c4d7dcc4e687fa72b52de84f5fa230b59c465402d5da5fc1a9cf99317cad65ec3edfd3f1b27b543
-
SSDEEP
6144:ORmYW9GKVm47QA6UGw7SbZvyejY5xY7oqH2QCiegW0KU/f:2bW9Tn6UGw7iZvNjYw28U0KU/f
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">P1JevGcvhR9jQHkRLfBzzCb4DnptRHJ0CKog9xo2rF/rFEyoqdH+F98IexOlyDrtV12xThcgSTsOtkZMnWlgYMw6btg2x8mhruk8QYUPAXHc3a/QkqdjJifYRNpkNeYt0IdQ2XCFINwHB2Rlyp9TKF3UhccVZnFauOHSknytae/DRm1nh8qGwcwe8eNlCaUWVapMCnljB02sQU6dOpYMqxG2NKyxh7aR218ztGlT5vcONSmiBXsrCXUVvlA3VMNsPEQwnxw9hrzAhsEikuaism/x50DbreROcESEX4PZEMTEbOpYTSI9Jppx28w1yKRRvkjDeenCz+ZXwBvWZt9DB5GBaZ/5hTQ7RFHs08m1QjOTeinfhnOjPS/OH5y8Jchy5sCnhyQb7gRAF/9tgB4dHZct92z3aETlpZHiqhEX08k3YUM0Q9Wb9g/Q2GD09u5tO6N3th9xQYfgc1FOL+u92wg9bXTLk1YauP4ul+vRRuXs3TxD3hx43BJtKmUeR6jRgzsgfkS+t9wAunXWrFBhcWWuAic+gA7Kjjqxz3PI/a+jFuGJMvhe8849MZTQxAgZAMspvrrzaxvECYFqeaNLZyAShclk35DuSRv2xaqerNvl6CB4hn9noHznwddc1GyqRK47MyMVXanTMfitXfsUNnKXhwQucWMm9Wd0qYKYJFOtzML/efHfwuVA2gXa6Y09hh0k/2q7GJ+S9ExbbS8eO3ZcH6FHBNjA0A0oNlC3uDNtvxNTSLrtFR1LtLziRCs18WEpL2D58ED35AtjDK3yUraZMZnN0Vc9/kaDho4LX31WHUZj46lR36XsmLLAblVTrsy4Nx1EvgazNlWo9l6TlvHCGAaf9Ry2ZuV+TgM5ByOjiWknkhY6uwRk6hxEOKL7WwO6+13TWr57Fznj/RpAwKcMd7gOiBQPWe5FRPVtJ2ApkXMQdHaQdwW5qbXKy9xfZnNpXsUcHpxpwMJpF6lcm2YV8h3OnBhc6KDTLyGgdwwdwdDt0MB3uztuMYhid36OkbiQzzWz4vH/MaJCBl0wAQ46PIJ5dvXouNTUzJVsLtYnIrKWzUD7n5ouH8Rky9wPqHRfo0N+4+WTeFxM+WfmANmCZ3d6p/0L0SwhOJCH/vPOl8eB17Mk8BJ0SIcsdBJS69JDb1X2GpTXkkVTa0QDmrmnYRsmMblkT9C4XcVcJxSnBde9iU1MA967am1dWh2rTls+/IxavBDup+9b0DTKk7pUMtjRNBr/ZDANExoGeCkx5aIJvO4KDmO0796aEFdtccPxoEpyHoWLGPbpxkSPmO0t6f9Q93fXgxYMMnEilGjAYSfiwsSb9mk+dRE1331dYKWZhJ+oE+56V4wEVofuqw1qboDFrnG+/cNkui00UMDByEtDkwpm+bSdqKWc3Jgf9je8PXTdcTtHKiAOVcZ3Qmy0qq4ph3wEUP2n5NBf3x1buhVItB8YaOImo9XzK1TuPztog8Z+ZJMMIHvlzQ6qaULex0bPvYrHTWaCKnKxnKZ0Y6q0A5+U6hMLvOpCmeCRLpWzp3JvhXOwFyly9x8NmrR2kiBzlQNcJb3i2TITC7vyG5419S/8gTC0yQEeha9Lb5K9nPBh6ZY0LotFmkucrYE/yRXkj6gGhc9QavFiyrvEMJ5qY5rexQXlaOHIgfkLNh+Praeph+pNBGi1yP4M4ecmERybhsEbIHfj7s0v124=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">96+WKDVi17TZDI3w0P0Prd/Zz7sOICxuxUSDpFBO3NGKEIXk9gbQ12xqdOYKIgMVmqQxMqUgCsbLxiKPUW7VNnHLWxw+zHj454qC9cOdENd9VFNw3idWPqJaGD5wlOWAuSTRXJrmXfieW49UJIPZhu5YAKh7/lqkW2J6QqyfHKAEo47Td+wj8RVTnUrsYy+rw1k0RbClzD0Zz12y0wD0+pG2kE/viNu+vYmXVeP5jRS3bNTQCGu1BaToNe56QILGuCUu3XGZDXWwPUrLVNrh2y1JVqzIBW5y8lILdc9KIckVNhZZBBiuyvk7SN9Rq4FOrbxC9hbC8aSKbKTjUQTojjWE0Yr6SfbI+Wx44jXs02TPtv34mtLtXcAzz/cd51dQNFxuWGySt74Io/otRuKh96jrW5++74Mnot+gSY5H/11aTWi/JIIVAoShrQYuKjMqkaYNeM2huHTxdWbGRs3wnIcuesEK6WJd53jkTyUYkT0d8Sn4YAAbCX45Gp3pzQ4m7TlCTYIXMEFXaYbcchq+LqqfQtTnGTuh06QWSP7WoIt6CPvMOfWqVaIs3jS/5Vy0+aJ4V9nueRXgrrws69yCUa8zszu/w3e09G53BFIVppzLXMk5SRTRN3oUPxhEH0uHZK4RTawIjMxG460sbduHj7sBRGWOlQFLioWuElhyZKKL/0B34u5s3ypmG/apz8Zp/YmzXtEZIIbt5mNggpvjqwUXs6LGeMwY4EG60pqTJywHItDJUADwiRPdC0v5BUR6ln+8J05NcVgtkrdKt2T1v1gJN9EzDh67Bj5350Tx33LqBgrJXWM/DVbfUcYDi4q8QlWpq94FDF2Os66ce6HT2e4XPJv6paE91o2b36RZgtuj9pbkEDPS3pwDHhmahs5lEDbI4QiKasEKjaT35k8q4GwIyaIbdp+4rzATcg7ta4bGB1VcXqvts95Cs2DzcSAH/ClDFM7U53XhCEUaOrqV7xm2x5pOzwukVHGSI+54700YZDwdK1KPQ+lXWmMNEUIgo61Df19DqFL9G9QzN5zK2DZw/DOi4gm7wzF0920VwETzNJOOLpIpXSpDHZ2ZeNfM5vKPPVz1TJniEqCZXVS3TBEnlN1HT2XCKQ3XQJevi71x1EH8CRKoD1QEjIfXDXMohGzIUqhOcISE8ghM54sjJ/AynaWm8s2g2rJubDpLT8fgVz1XuOqnXfFHN/agjSMTkcIzWOtwlmFrWA7Dl6mWQgJTPApFlccUhrMMhL/hQ327m9WAgRP1M5PR0tetk0LKJ91qBcgv+YMSd7Vh4AVuHHQdllRh6h+NETUBYRZu16OdrEAv0geap2yzKgXS3Unz9N/G454J+YjBsNRf6eyQx7kff5NDTqnNVz0dJr0S6BrHNDcAPtwW+DZXaHrQ2mYTAfkYSnaaIIDO3uC31815IGpJAFz8CBCcr9w/+4YE+T0NjuPokiBRG1DbtmfKU/9wgx86is9bvyBv/QCebeaFyj3oqK8Nt972qZohtYejI/gWNCDnx33OG/ORyBG5JqeYEuT5vXcZ9lNPt1pVbclXgYDQ4A5IH6R59wb9HY8LNuEFqRMNVGZwPau4DvV/L8Vt+tblRp5hyz3YkO/GOsqIw914oFHcunbyW7OxjT1XMSOCR+ViF/Mc3SSxLq1U8IVRRKoWeIJlg5Ptx6QDB+WU3n/dss+ivoOBXa8cvU6EV0c=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
M.exe
-
Size
311KB
-
MD5
afddf1db7b4dd2928105e34d2e3e7054
-
SHA1
bba5a0c24a06abc2edc79bd1432b74f217a9da25
-
SHA256
48046fb0e566f5a2d184f84b76d6cadc458762556daed0ae4a3a1200afbefb54
-
SHA512
2f1aa2fd2c1b2189889c7a0eb90c3f9b5a278b5ed11964927c4d7dcc4e687fa72b52de84f5fa230b59c465402d5da5fc1a9cf99317cad65ec3edfd3f1b27b543
-
SSDEEP
6144:ORmYW9GKVm47QA6UGw7SbZvyejY5xY7oqH2QCiegW0KU/f:2bW9Tn6UGw7iZvNjYw28U0KU/f
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Deletes system backups
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Installed Components in the registry
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-