41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629

General

Target
41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe
Size 223KB
Sample221221-p1rdtafd71
SHA256 41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629
MD5 c27f23181c3ebd80f3dae27d88b86267
SHA1 12bef40a06323256fc0e903503a49f4623af7dcb
SHA512 b22159a971988198fee78f861ad938dfce12ba5b993593b7bfd4e54938b95d39b6f3d09ed4a9be7081181a8499a7aeac3a47a2edfab52812e7757c6d53d753ce
SSDEEP 3072:8Cut7gBHz/0OUGyQkRACh3Uim7ef10wYaGyeG7sGcMBIGv:3udgBHz/pUNlRAC+bu1iaGy3Jv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Readme_Instructions.html

Ransom Note

<!DOCTYPE HTML> <html><head><title>infected with ransomware virus</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> </head> <body style="margin: 0.4em; font-size: 14pt;">!!!    Your files are encrypted  !!! *All your files are protected with encryption* *There is no public decryption software.* *All files/documents/software with ".CRYPT" extension is encrypted* ###### Program and private key, What is the price? The price depends on how fast you can pay us.!###### 1 day : 50 Bitcoin 2 day : 60 Bitcoin 3 day : 90 Bitcoin 4 day : 130 Bitcoin 5 day    : permanent data loss !!!! ***How to contact our team through tox chat*** *Download tox chat from *<a href="https://tox.chat/download.html">https://tox.chat/download.html</a> *send us friend request to tox chat id 7D8796EB86CBF29F53F8A8447EABAF310ED898D9DEFF97AE09C1864C2A6B3B14ED8F82AE9B9D *Our team is waiting* !!!!For immediate decryption!!! write to our email: <a href="mailto:[email protected]">[email protected]</a> *After payment received, we will send private key to your IT department.!!!* *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.* !!! We have downloaded all your files to our servers and will release data if you do not comply.!!! !!! Do not attempt to decrypt your data using third-party software, this will result in permanent data loss.!!!</body></html>

Emails

href="mailto:[email protected]">[email protected]</a>

URLs

http-equiv="X-UA-Compatible"

Targets

- Target
  41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe
- Size 223KB
- SHA256 41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629
- MD5 c27f23181c3ebd80f3dae27d88b86267
- SHA1 12bef40a06323256fc0e903503a49f4623af7dcb
- SHA512 b22159a971988198fee78f861ad938dfce12ba5b993593b7bfd4e54938b95d39b6f3d09ed4a9be7081181a8499a7aeac3a47a2edfab52812e7757c6d53d753ce
- SSDEEP 3072:8Cut7gBHz/0OUGyQkRACh3Uim7ef10wYaGyeG7sGcMBIGv:3udgBHz/pUNlRAC+bu1iaGy3Jv
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ransomware spyware stealer
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2