cba18059932eb9cabf057920f3f13e453859c48582d9fd045bf54c08fa1e8f88

General

Target

tmp
Size

577KB
Sample

230425-pjry1sac79
MD5

6b14afc862d4daba3cf229881c11c3d5
SHA1

127f583b536ee4721276b7b30f22349a3dcd313c
SHA256

cba18059932eb9cabf057920f3f13e453859c48582d9fd045bf54c08fa1e8f88
SHA512

ad4294281780581483c4a88f873328a79d79d6af7f432b708319cff3320fba0831a1293dc484957abc2f4b1847edf1447de2087d0fe2e92a0c318e383ba5c181
SSDEEP

12288:2Jg8ZbVIAWrUuKiG1BWjZ1Yen/XYPKPN4JwtRRPdQG+:AH6+oDjn/XYPqBX1K

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\FILE RECOVERY.txt

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 1DA1E427CC675F868A99910B 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Extracted

Path

C:\Program Files\7-Zip\Lang\FILE RECOVERY.txt

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 239EA731742917B0545DA646 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

- Target
  
  tmp
- Size
  
  577KB
- MD5
  
  6b14afc862d4daba3cf229881c11c3d5
- SHA1
  
  127f583b536ee4721276b7b30f22349a3dcd313c
- SHA256
  
  cba18059932eb9cabf057920f3f13e453859c48582d9fd045bf54c08fa1e8f88
- SHA512
  
  ad4294281780581483c4a88f873328a79d79d6af7f432b708319cff3320fba0831a1293dc484957abc2f4b1847edf1447de2087d0fe2e92a0c318e383ba5c181
- SSDEEP
  
  12288:2Jg8ZbVIAWrUuKiG1BWjZ1Yen/XYPKPN4JwtRRPdQG+:AH6+oDjn/XYPqBX1K
Score

10^/10

discovery evasion ransomware
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies service settings
  Alters the configuration of existing services.
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2