Resubmissions

12-04-2023 12:13

230412-pdq5jacb34 10

05-02-2023 23:00

230205-2zfl5sef2z 10

General

  • Target

    svcshost.exe

  • Size

    493KB

  • Sample

    230412-pdq5jacb34

  • MD5

    c15bd704405c47f1cf081cba3ec67d17

  • SHA1

    5c74894ad0228821cef1794cfeb6a989e7ec551a

  • SHA256

    0e1afd3c9ee17408c055e272c2087fdb1e759c8a4b9373fcf2a4bf81d041b58e

  • SHA512

    aa00445344d0c8b81ef983f931063ca20cd3510e588e26fcab342b6cb2af894a119c8ba10f9b103bbc16c9d04089b6817a0545ebe6975ce51a5eb03479c3cb7a

  • SSDEEP

    12288:vNoGU5LsJBWYgeWYg955/155/kjDP9XBDZQN/WioxCcjyoUoecWR:lstsJFjDFXFZQNWioxlyoUr3

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\__READ_ME_TO_RECOVER_YOUR_FILES.txt

Ransom Note
Hello, your files were encrypted and are currently unusable. The only way to recover your files is decrypting them with a key that only we have. In order for us to send you the key and the application to decrypt your files, you will have to make a transfer of Bitcoins to an electronic wallet. We leave you here the data to make the bitcoins transfer. Bitcoin wallet: 398sW5eMDvyr93CJHKRD3eYE9vK5ELVrHP Transfer the amount of bitcoins equivalent to 200 USD. Your computer ID is: 2007c659-eb65-4631-bf41-16f7650120a3 Once you make the transfer of bitcoins, send us the transfer ID and your computer ID to our email: nhands_q647t@pudxe.com When we verify the transfer we will send you your key and the decryption application.
Emails

nhands_q647t@pudxe.com

Wallets

398sW5eMDvyr93CJHKRD3eYE9vK5ELVrHP

Targets

    • Target

      svcshost.exe

    • Size

      493KB

    • MD5

      c15bd704405c47f1cf081cba3ec67d17

    • SHA1

      5c74894ad0228821cef1794cfeb6a989e7ec551a

    • SHA256

      0e1afd3c9ee17408c055e272c2087fdb1e759c8a4b9373fcf2a4bf81d041b58e

    • SHA512

      aa00445344d0c8b81ef983f931063ca20cd3510e588e26fcab342b6cb2af894a119c8ba10f9b103bbc16c9d04089b6817a0545ebe6975ce51a5eb03479c3cb7a

    • SSDEEP

      12288:vNoGU5LsJBWYgeWYg955/155/kjDP9XBDZQN/WioxCcjyoUoecWR:lstsJFjDFXFZQNWioxlyoUr3

    Score
    10/10
    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

MITRE ATT&CK Matrix

Tasks