724aa6dae72829e9812b753d188190e16fb64ac6cd39520897d917cfdccc5122

General

Target

tmp
Size

19KB
Sample

221229-x7s5zshb8y
MD5

6845db47108d6324b9fcad6707cfcff6
SHA1

2dc793dc4e5452cfe91887e9f7f65fb918e7d302
SHA256

724aa6dae72829e9812b753d188190e16fb64ac6cd39520897d917cfdccc5122
SHA512

1afd7b1ca8084e4449c5e9c57574ba37c99b744e8d0725a754dcc52da40392e12875581939d429ec44fed9b2ee31101d00f8ae520c003d1e9c2fa67f018f5d3e
SSDEEP

192:Z84NAAxdT8XvF9XAtntctn9wjStptlqU6tct76t66tsW6tVthttctPt3Zt3tubtt:muAadY/HzJjW

Score

10^/10

Malware Config

Extracted

Path

C:\FILE RECOVERY.txt

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 5C1D3141872DA0BB83FBB71A 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

- Target
  
  tmp
- Size
  
  19KB
- MD5
  
  6845db47108d6324b9fcad6707cfcff6
- SHA1
  
  2dc793dc4e5452cfe91887e9f7f65fb918e7d302
- SHA256
  
  724aa6dae72829e9812b753d188190e16fb64ac6cd39520897d917cfdccc5122
- SHA512
  
  1afd7b1ca8084e4449c5e9c57574ba37c99b744e8d0725a754dcc52da40392e12875581939d429ec44fed9b2ee31101d00f8ae520c003d1e9c2fa67f018f5d3e
- SSDEEP
  
  192:Z84NAAxdT8XvF9XAtntctn9wjStptlqU6tct76t66tsW6tVthttctPt3Zt3tubtt:muAadY/HzJjW
Score

10^/10

evasion persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies service settings
  Alters the configuration of existing services.
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2