ctblocker | d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79

General

Target

d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79
Size

954KB
Sample

221128-vybs8sfh7t
MD5

856cefc0c0bbe54ac88d71135c3437df
SHA1

a3175ff2386fb6a266743fba99e72549b5281d62
SHA256

d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79
SHA512

17d369d2ca266b72abbabb41405699f09934525175e230d7fa4342efa6242e0642a9b23f60c23934aa33e63cd7e31715356ce948ccabd3510274da028e99eb65
SSDEEP

24576:pWt9iMnSn9wESmhYJBg3CztbeNr5X4GOL8:Ut9iMnSn9wE8JqYtaNr5XsY

Score

10^/10

ctblocker ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-abrgzxi.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://pf5dahldauhrjxfd.onion.cab or http://pf5dahldauhrjxfd.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://pf5dahldauhrjxfd.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. PNTWLNP-5NWGYBY-HS7X4XB-DY6SQPM-BXFCXEV-MUHL6HZ-WGQFIHD-ZRMFJ4A I2FW5N3-37XBAXS-G447I4Z-JPRW5WY-JQJMJLE-7I3GVVO-4LT2PL7-7HYKKMN HJUN2YH-RV2ITAE-XAF5UTN-IQJYHI2-GC26EHO-UISSXP6-HUSJ7YY-IIMVDCG Follow the instructions on the server.

URLs

http://pf5dahldauhrjxfd.onion.cab

http://pf5dahldauhrjxfd.tor2web.org

http://pf5dahldauhrjxfd.onion/

Extracted

Path

C:\Users\Admin\Documents\!Decrypt-All-Files-abrgzxi.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://pf5dahldauhrjxfd.onion.cab or http://pf5dahldauhrjxfd.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://pf5dahldauhrjxfd.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. PNTWLNP-5NWGYBY-HS7X4XB-DY6SQPM-BXFCXEV-MUHL6HZ-WGQFIHD-ZRMFJ4A I2FW5N3-37XBAXS-G447I4Z-JPRW5WY-JQJMJLE-7I3GVVO-4LT2PL7-7HYKKMN HJUN2YH-RV2ITAE-XAF5UTN-IQJYHI2-GC26WVO-QRSSXP6-HUSJ7YY-IIMFPIT Follow the instructions on the server.

URLs

http://pf5dahldauhrjxfd.onion.cab

http://pf5dahldauhrjxfd.tor2web.org

http://pf5dahldauhrjxfd.onion/

Extracted

Path

C:\ProgramData\zlwdkgg.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://pf5dahldauhrjxfd.onion.cab or http://pf5dahldauhrjxfd.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://pf5dahldauhrjxfd.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://pf5dahldauhrjxfd.onion.cab

http://pf5dahldauhrjxfd.tor2web.org

http://pf5dahldauhrjxfd.onion

Targets

- Target
  
  d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79
- Size
  
  954KB
- MD5
  
  856cefc0c0bbe54ac88d71135c3437df
- SHA1
  
  a3175ff2386fb6a266743fba99e72549b5281d62
- SHA256
  
  d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79
- SHA512
  
  17d369d2ca266b72abbabb41405699f09934525175e230d7fa4342efa6242e0642a9b23f60c23934aa33e63cd7e31715356ce948ccabd3510274da028e99eb65
- SSDEEP
  
  24576:pWt9iMnSn9wESmhYJBg3CztbeNr5X4GOL8:Ut9iMnSn9wE8JqYtaNr5XsY
Score

10^/10

ctblocker ransomware
- CTB-Locker
  Ransomware family which uses Tor to hide its C2 communications.
  ransomware ctblocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2