General

  • Target

    0744564f6d0b5593008da4e7e628dfd1b340c70752fc7fa8f65b5ae50841c1f7

  • Size

    208KB

  • Sample

    221128-b5bx2aaf2v

  • MD5

    b4347012829efc382f852db233582fcd

  • SHA1

    c515bfc0e2f5c92945cd4cae8f2b6434c720e344

  • SHA256

    0744564f6d0b5593008da4e7e628dfd1b340c70752fc7fa8f65b5ae50841c1f7

  • SHA512

    4d512666c99651c186be7963e1629151ee27bdd7464c23d357cc7a8f572e7dfead9fa78f3e6f14bab747ddfa3b5624079cf7694a04d7486b43bd4e3d68284366

  • SSDEEP

    6144:wKhhJS1IJyE/HBXw/KWM0QZ/oQt92Y2Et5k:wKhhGIJyE/Hhwyr0+/Hk

Score
10/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_INSTRUCTION.html

Ransom Note
<title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Y4jWR32Os2</b>

Targets

    • Target

      0744564f6d0b5593008da4e7e628dfd1b340c70752fc7fa8f65b5ae50841c1f7

    • Size

      208KB

    • MD5

      b4347012829efc382f852db233582fcd

    • SHA1

      c515bfc0e2f5c92945cd4cae8f2b6434c720e344

    • SHA256

      0744564f6d0b5593008da4e7e628dfd1b340c70752fc7fa8f65b5ae50841c1f7

    • SHA512

      4d512666c99651c186be7963e1629151ee27bdd7464c23d357cc7a8f572e7dfead9fa78f3e6f14bab747ddfa3b5624079cf7694a04d7486b43bd4e3d68284366

    • SSDEEP

      6144:wKhhJS1IJyE/HBXw/KWM0QZ/oQt92Y2Et5k:wKhhGIJyE/Hhwyr0+/Hk

    Score
    10/10
    • CryptoWall

      Ransomware family which is an improved version of the older CryptoDefense.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix

Tasks