General
- Target 17b923990673b325ab31bbe045ba49d4f39a6b9412c36cce136da2ce9fbb8995
- Size 204KB
- Sample221128-wnd2aaec22
- SHA256 17b923990673b325ab31bbe045ba49d4f39a6b9412c36cce136da2ce9fbb8995
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\Lang\DECRYPT_INSTRUCTION.html
Ransom Note
- <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b>
Targets
-
- Target 17b923990673b325ab31bbe045ba49d4f39a6b9412c36cce136da2ce9fbb8995
- Size 204KB
- SHA256 17b923990673b325ab31bbe045ba49d4f39a6b9412c36cce136da2ce9fbb8995
Score10/10-
CryptoWall
Ransomware family which is an improved version of the older CryptoDefense.
-
Drops desktop.ini file(s)