General
- Target Ransomware.Win32.Crypt360.zip
- Size 550KB
- Sample230331-v56l7add6x
- SHA256 f4d054949f5c075827e9e9d1ad82231adc9f0af9e64637927e967ffddf1116cc
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\Temp\Low\!_INFO.txt
Ransom Note
- WARNING! YOUR FILES ARE ENCRYPTED! Don’t worry, your files are safe, provided that you are willing to pay the ransom. Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently! Do not rename your files. It will damage it. The only way to decrypt your files safely is to buy the special decryption software from us. Before paying you can send us up to 2 files for free decryption as guarantee. No database files for test. Send pictures, text, doc files. (files no more than 1mb) You can contact us with the following email [email protected] [email protected] Send us this ID or this file in first email ID: AofaYFgwqL47fiBUHhw1VRNqJ3afpMuBUVzfVr+0/Ww=:b169ebacc1fdf8cb1c9ed4d8f083b48dc29218ea8c94090465563c3d36c3600f
Extracted
Path
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\!_INFO.txt
Ransom Note
- WARNING! YOUR FILES ARE ENCRYPTED! Don’t worry, your files are safe, provided that you are willing to pay the ransom. Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently! Do not rename your files. It will damage it. The only way to decrypt your files safely is to buy the special decryption software from us. Before paying you can send us up to 2 files for free decryption as guarantee. No database files for test. Send pictures, text, doc files. (files no more than 1mb) You can contact us with the following email [email protected] [email protected] Send us this ID or this file in first email ID: 6XSJPpDFGStCH1FNpiAaexScPo0ha1vujSF86KxHWHo=:b169ebacc1fdf8cb1c9ed4d8f083b48dc29218ea8c94090465563c3d36c3600f
Targets
-
- Target Test
- Size 563KB
- SHA256 c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application