General
-
Target
8470683659.zip
-
Size
101KB
-
Sample
221129-gq9teafc6w
-
MD5
8748ab4c524f1a6db3a102a87a09a12e
-
SHA1
546782fffe627c179fb47cfadef0399f294de26e
-
SHA256
345d50f95494d886ce9003ee365a0cfae2393a811384520b8ff709ccf29c29ca
-
SHA512
3de443ec81d59bf08ba82797498fbd470b73f1d1788d89b5b906607aaeab16bb22c61ee7e94bedc0d6febc0c145ef5c4266e216b1b2de98b4e7a94f526ea140c
-
SSDEEP
3072:oCqI79HLjJ4N8zlFW4xiEWbdNogpq7IwTlCjj:oTIZHLjJ4UNifyCjj
Score
10/10
Malware Config
Extracted
Path
\??\Z:\WE CAN RECOVER YOUR DATA.MHT
Ransom Note
From:
Subject:
Date:
MIME-Version: 1.0
Content-Type: multipart/related; type="text/html"; boundary="=_MONSTER"
This is a multi-part message in MIME format.
--=_MONSTER
Content-Type: text/html; charset="UTF-8"
Content-Location: 666
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/transitional.dtd">
<html>
<head>
<meta charset="windows-1251">
<title></title>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note ul {
margin-top: 0;
}
</style>
</head>
<body>
<div class="header">YOUR FILES ARE ENCRYPTED</div>
<div class="bold">Your files, documents, photos, databases and other important files are encrypted.</div>
<div>You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key.
Only we can give you this key and only we can recover your files.</div>
<div>To be sure we have the decryptor and it works you can send an email: dear_decript2022@mail2tor.com and decrypt one file for free.
But this file should be of not valuable!</div>
<div class="note info">
<div class="title">Do you really want to restore your files?</div>
<ul>
<li>Write to email: dear_decript2022@mail2tor.com </li>
<li>The alternative way to contact us is to use Jabber: dear_decript2022@jabbim.com </li>
</ul>
</div>
<div>Your personal ID: 5598BD4C</div>
<div class="note alert">
<div class="title">Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
--=_MONSTER--
Emails
dear_decript2022@mail2tor.com
dear_decript2022@jabbim.com
Extracted
Path
C:\WE CAN RECOVER YOUR DATA.MHT
Ransom Note
From:
Subject:
Date:
MIME-Version: 1.0
Content-Type: multipart/related; type="text/html"; boundary="=_MONSTER"
This is a multi-part message in MIME format.
--=_MONSTER
Content-Type: text/html; charset="UTF-8"
Content-Location: 666
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/transitional.dtd">
<html>
<head>
<meta charset="windows-1251">
<title></title>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note ul {
margin-top: 0;
}
</style>
</head>
<body>
<div class="header">YOUR FILES ARE ENCRYPTED</div>
<div class="bold">Your files, documents, photos, databases and other important files are encrypted.</div>
<div>You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key.
Only we can give you this key and only we can recover your files.</div>
<div>To be sure we have the decryptor and it works you can send an email: dear_decript2022@mail2tor.com and decrypt one file for free.
But this file should be of not valuable!</div>
<div class="note info">
<div class="title">Do you really want to restore your files?</div>
<ul>
<li>Write to email: dear_decript2022@mail2tor.com </li>
<li>The alternative way to contact us is to use Jabber: dear_decript2022@jabbim.com </li>
</ul>
</div>
<div>Your personal ID: 305B1D1E</div>
<div class="note alert">
<div class="title">Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
--=_MONSTER--
Emails
dear_decript2022@mail2tor.com
dear_decript2022@jabbim.com
Targets
-
-
Target
99cb1513a0b129c85d10b008919e821584a2c17e17473c44e187a4e74b0af3ad
-
Size
190KB
-
MD5
b611d618e63419ec9b8e257635991d14
-
SHA1
7f7185104dc5d3b814029ccc9772bbe60f64c0f4
-
SHA256
99cb1513a0b129c85d10b008919e821584a2c17e17473c44e187a4e74b0af3ad
-
SHA512
1dff9fa251374dbb419dbc785148025d5870609fced89a8aa58e5b290836944439a01e12da3f8d95a3939e4ead5111fccf52bfcca862dd954bd0caa13b396e29
-
SSDEEP
3072:v3blGV9hulKmhbfvjv69vF6nHynNPFW7Lifa81HhqGUQjN9l8P40N2L:v3bq9UlKgPuEyNFWSb1HV3h8P40IL
Score10/10-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-