General
- Target 484610906f2d623fe3bbafa4744c7003c82b71af7de8e289d9c0277f75dddba8
- Size 204KB
- Sample221127-bgptzsch4w
- SHA256 484610906f2d623fe3bbafa4744c7003c82b71af7de8e289d9c0277f75dddba8
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\Lang\DECRYPT_INSTRUCTION.html
Ransom Note
- <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://rq4ul32ph34j2ghn.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>q8Hzx6dl9</b>
Targets
-
- Target 484610906f2d623fe3bbafa4744c7003c82b71af7de8e289d9c0277f75dddba8
- Size 204KB
- SHA256 484610906f2d623fe3bbafa4744c7003c82b71af7de8e289d9c0277f75dddba8
Score10/10-
CryptoWall
Ransomware family which is an improved version of the older CryptoDefense.
-
Drops desktop.ini file(s)