f730e83049c7fe81f6e4765ab91efbb7a373751d51fdafe697a4977dc7c1ea11

General

Target

tmp
Size

37KB
Sample

221217-y5g6dahe55
MD5

cb1ba70812eda56152bd1e2186acabe9
SHA1

0416d3296a3e4ad7b3746d01f79c13f1166a6a3f
SHA256

f730e83049c7fe81f6e4765ab91efbb7a373751d51fdafe697a4977dc7c1ea11
SHA512

6d05ae0e84173f43a551f8554ef9dbd6a2a0da2686c4ed065afd4b898e2638ecd755978a2fc55a6a92bbb717915e9537ef73c8819209f662fe2083fd873b29af
SSDEEP

768:QoYoqEeq17XpwE3sKfkCbJokUP/W19qpBo1P2:92s71D6xP/W7qmP2

Score

10^/10

Malware Config

Extracted

Path

C:\FILE RECOVERY.txt

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: F0947D2AF7F136182169A291 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Extracted

Path

C:\FILE RECOVERY.txt

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 16F6A89E0324DEC75FDE4442 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

- Target
  
  tmp
- Size
  
  37KB
- MD5
  
  cb1ba70812eda56152bd1e2186acabe9
- SHA1
  
  0416d3296a3e4ad7b3746d01f79c13f1166a6a3f
- SHA256
  
  f730e83049c7fe81f6e4765ab91efbb7a373751d51fdafe697a4977dc7c1ea11
- SHA512
  
  6d05ae0e84173f43a551f8554ef9dbd6a2a0da2686c4ed065afd4b898e2638ecd755978a2fc55a6a92bbb717915e9537ef73c8819209f662fe2083fd873b29af
- SSDEEP
  
  768:QoYoqEeq17XpwE3sKfkCbJokUP/W19qpBo1P2:92s71D6xP/W7qmP2
Score

10^/10

evasion persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies service settings
  Alters the configuration of existing services.
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2