Overview

overview

10

Static

static

1

97a997a2a.dll

windows7-x64

10

97a997a2a.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    97a997a2a.dll

  • Size

    1.6MB

  • Sample

    230323-pryrjahe6z

  • MD5

    c47487a80b0873549074634cdcf52937

  • SHA1

    056dafdfe9de1460cc396e097947db8286fc845a

  • SHA256

    97a997a2a3b270a4db3b56fec30319bc0f41f069a5089c47f08e4c554bf3ac32

  • SHA512

    1f447151348b1cc4d2ed4b896d45a91cbe34674987135bad69701f54c15a4526c7235e07238ea5cbe1f89483a39542dd36ab546c41e99eb9e789d84743828759

  • SSDEEP

    24576:yUbdgXkRLmlAbd3HVyenqbG1Wf1r/sx9NB2QIg7eCH+TQ0+:3bdgXkR8OFyenqbGoAjB2QIEneTr+

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Ransom Note
ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: b3755e21-718d-4a53-a71f-ce2cf26b0e02 *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.
URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

    • Target

      97a997a2a.dll

    • Size

      1.6MB

    • MD5

      c47487a80b0873549074634cdcf52937

    • SHA1

      056dafdfe9de1460cc396e097947db8286fc845a

    • SHA256

      97a997a2a3b270a4db3b56fec30319bc0f41f069a5089c47f08e4c554bf3ac32

    • SHA512

      1f447151348b1cc4d2ed4b896d45a91cbe34674987135bad69701f54c15a4526c7235e07238ea5cbe1f89483a39542dd36ab546c41e99eb9e789d84743828759

    • SSDEEP

      24576:yUbdgXkRLmlAbd3HVyenqbG1Wf1r/sx9NB2QIg7eCH+TQ0+:3bdgXkR8OFyenqbGoAjB2QIEneTr+

    Score
    10/10
    ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks