ctblocker | 4edebdad5db6686b6d2310bac908929c40bb126f0d67bc6251207c397b23e0c7

General

Target

4edebdad5db6686b6d2310bac908929c40bb126f0d67bc6251207c397b23e0c7
Size

698KB
Sample

221128-qvey9sca5s
MD5

438fee4986d75c2fb9a1f9239010f8ca
SHA1

c29e54756f10517557349c0bdb573d7847e00429
SHA256

4edebdad5db6686b6d2310bac908929c40bb126f0d67bc6251207c397b23e0c7
SHA512

ea6fd27158a95f167074548200aef75cb0089c47ac9a21a074374bd082f3d44ae4e21baa490cb1869351010b8e11f7815f44c7d4bd89b26e8296aa4dd55d8598
SSDEEP

12288:pQyHYh6UeeLrQp0/XoU8bTRsdi9JSZPLGhX9H1QO7l4n2A1muOhsXL:pQ6UeeLkMB8bTRskSjeXh+Ok7OhY

Score

10^/10

ctblocker ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-mhgskmn.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://kph3onblkthy4z37.onion.cab or http://kph3onblkthy4z37.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://kph3onblkthy4z37.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. 6WCRS77-DBOFNW4-JLVAU7U-T7VUYWU-SHSKRE6-DKLGWGB-BMOPMIH-Y5IIXRT 7Q4B7SU-DWQTEPV-BK6LEBN-NX6N6OC-D3JXPJG-7WCIWU3-3OGKCWT-AUY22OR LG7FZRX-66AFYWK-UWQRYCY-2WKSXNI-QHTTXKP-XJ4GPFG-XAOQARD-XAXW2PO Follow the instructions on the server.

URLs

http://kph3onblkthy4z37.onion.cab

http://kph3onblkthy4z37.tor2web.org

http://kph3onblkthy4z37.onion/

Extracted

Path

C:\Users\Admin\Documents\!Decrypt-All-Files-mhgskmn.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://kph3onblkthy4z37.onion.cab or http://kph3onblkthy4z37.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://kph3onblkthy4z37.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. 6WCRS77-DBOFNW4-JLVAU7U-T7VUYWU-SHSKRE6-DKLGWGB-BMOPMIH-Y5IIXRT 7Q4B7SU-DWQTEPV-BK6LEBN-NX6N6OC-D3JXPJG-7WCIWU3-3OGKCWT-AUY22OR LG7FZRX-66AFYWK-UWQRYCY-2WKSXNI-QHTTGYP-774GPFG-XAOQARD-XAXG2FS Follow the instructions on the server.

URLs

http://kph3onblkthy4z37.onion.cab

http://kph3onblkthy4z37.tor2web.org

http://kph3onblkthy4z37.onion/

Extracted

Path

C:\ProgramData\nydzthc.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://kph3onblkthy4z37.onion.cab or http://kph3onblkthy4z37.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://kph3onblkthy4z37.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://kph3onblkthy4z37.onion.cab

http://kph3onblkthy4z37.tor2web.org

http://kph3onblkthy4z37.onion

Targets

- Target
  
  4edebdad5db6686b6d2310bac908929c40bb126f0d67bc6251207c397b23e0c7
- Size
  
  698KB
- MD5
  
  438fee4986d75c2fb9a1f9239010f8ca
- SHA1
  
  c29e54756f10517557349c0bdb573d7847e00429
- SHA256
  
  4edebdad5db6686b6d2310bac908929c40bb126f0d67bc6251207c397b23e0c7
- SHA512
  
  ea6fd27158a95f167074548200aef75cb0089c47ac9a21a074374bd082f3d44ae4e21baa490cb1869351010b8e11f7815f44c7d4bd89b26e8296aa4dd55d8598
- SSDEEP
  
  12288:pQyHYh6UeeLrQp0/XoU8bTRsdi9JSZPLGhX9H1QO7l4n2A1muOhsXL:pQ6UeeLkMB8bTRskSjeXh+Ok7OhY
Score

10^/10

ctblocker ransomware
- CTB-Locker
  Ransomware family which uses Tor to hide its C2 communications.
  ransomware ctblocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2