fb7fb354d53bba7d8b06e54ff4353391104309bde96ed4dfb61cfd4734616fcd

General

Target

fb7fb354d53bba7d8b06e54ff4353391104309bde96ed4dfb61cfd4734616fcd
Size

518KB
Sample

221128-dagk5shg53
MD5

2967db42ae55218f11340027c64331fe
SHA1

1bb9e2bf9e5a27f113f521dde30646af18c2cbd5
SHA256

fb7fb354d53bba7d8b06e54ff4353391104309bde96ed4dfb61cfd4734616fcd
SHA512

4f84c6e045c88f93480522e8c35a3d701fa36bbee6285c1550d4cb1af87d06661daa31647ae9c2e1f4a8a31cbab7e58165c67f710bf71992b7d40b177ebb28e0
SSDEEP

12288:h6zkzrbETCl/7ZBH+Fxc3sgmrpgkue8lP5/w+FirOHskFgFwIyXCDu8:n76Cp7ZBH+FeNt7mr6skFgqIyX

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\odt\ReadMe.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?101ZQRTVWYA 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5

URLs

http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?101ZQRTVWYA

https://yip.su/2QstD5

Targets

- Target
  
  fb7fb354d53bba7d8b06e54ff4353391104309bde96ed4dfb61cfd4734616fcd
- Size
  
  518KB
- MD5
  
  2967db42ae55218f11340027c64331fe
- SHA1
  
  1bb9e2bf9e5a27f113f521dde30646af18c2cbd5
- SHA256
  
  fb7fb354d53bba7d8b06e54ff4353391104309bde96ed4dfb61cfd4734616fcd
- SHA512
  
  4f84c6e045c88f93480522e8c35a3d701fa36bbee6285c1550d4cb1af87d06661daa31647ae9c2e1f4a8a31cbab7e58165c67f710bf71992b7d40b177ebb28e0
- SSDEEP
  
  12288:h6zkzrbETCl/7ZBH+Fxc3sgmrpgkue8lP5/w+FirOHskFgFwIyXCDu8:n76Cp7ZBH+FeNt7mr6skFgqIyX
Score

10^/10

persistence ransomware
- Modifies Installed Components in the registry
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1