General
-
Target
Trojan-Ransom.Win32.Snocry.dmv-8f9a62a9e43ed55f0fa810737facc6460dc89c41f16f4d610debc8a35babe6b9
-
Size
84KB
-
Sample
230425-v1h1bsbh48
-
MD5
420b2f010edbc63a68b2cce2cdf1e5e9
-
SHA1
4cf5072cfe0eb42d387713067e2706902c89b294
-
SHA256
8f9a62a9e43ed55f0fa810737facc6460dc89c41f16f4d610debc8a35babe6b9
-
SHA512
de85edb0217c3d1e615e81154831fe0f3f7c7514f843f253eecf38da09895558b4dc71c1e4141dd196bda7aa75d2c14c85658355a834f98238370df0bea46f35
-
SSDEEP
1536:cYYxci1ZP39zud52ilpPXvlMq12Kpuyjg1kF3mI:+xFyd52ilpPX6q2y8kF3j
Score
10/10
Malware Config
Extracted
Path
C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private softWare with a low price!
E-MAIL1: enc4@usa.com
E-MAIL2: enc4@dr.com
Spare email:
E-MAIL1: enc4r@usa.com
E-MAIL2: enc4r@dr.com
Emails
enc4@usa.com
enc4@dr.com
enc4r@usa.com
enc4r@dr.com
Extracted
Path
C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private softWare with a low price!
E-MAIL1: enc4@usa.com
E-MAIL2: enc4@dr.com
Spare email:
E-MAIL1: enc4r@usa.com
E-MAIL2: enc4r@dr.com
YOUR_ID: 2013d4951c9b74ea
Emails
enc4@usa.com
enc4@dr.com
enc4r@usa.com
enc4r@dr.com
Extracted
Path
C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.HTML
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>HELP_DECRYPT_YOUR_FILES</title>
<style>
.text {
text-align: center;
}
</style>
</head>
<body>
<div class="text">
<strong>NOT YOUR LANGUAGE?</strong> USE <a href="https://translate.google.com">https://translate.google.com</a><br><br>
<strong>What happened to your files ?</strong><br>
All of your files were protected by a strong encryption with RSA-2048.<br>
More information about the encryption keys using RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br><br>
<strong>How did this happen ?</strong><br>
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.<br>
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.<br>
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server <br><br>
<strong>What do I do ?</strong><br>
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.<br>
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.<br><br>
<strong>For more specific instructions:</strong><br>
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. <br>
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. <br>
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private softWare with a low price! <br>
<strong>E-MAIL1:</strong> enc4@usa.com<br>
<strong>E-MAIL2:</strong> enc4@dr.com<br>
Spare email if we do not respond within 24 hours:<br>
<strong>E-MAIL1:</strong> enc4r@usa.com<br>
<strong>E-MAIL2:</strong> enc4r@dr.com<br>
<strong>YOUR_ID: 2013d4951c9b74ea</strong>
</div>
</body>
</html>
Emails
enc4@usa.com<br>
enc4@dr.com<br>
enc4r@usa.com<br>
enc4r@dr.com<br>
Extracted
Path
C:\Users\Admin\Documents\HELP_DECRYPT_YOUR_FILES.HTML
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private softWare with a low price!
E-MAIL1: enc4@usa.com
E-MAIL2: enc4@dr.com
Spare email if we do not respond within 24 hours:
E-MAIL1: enc4r@usa.com
E-MAIL2: enc4r@dr.com
YOUR_ID: 2013d4951c9b74ea
Emails
enc4@usa.com
enc4@dr.com
enc4r@usa.com
enc4r@dr.com
Extracted
Path
C:\Users\HELP_DECRYPT_YOUR_FILES.HTML
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>HELP_DECRYPT_YOUR_FILES</title>
<style>
.text {
text-align: center;
}
</style>
</head>
<body>
<div class="text">
<strong>NOT YOUR LANGUAGE?</strong> USE <a href="https://translate.google.com">https://translate.google.com</a><br><br>
<strong>What happened to your files ?</strong><br>
All of your files were protected by a strong encryption with RSA-2048.<br>
More information about the encryption keys using RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br><br>
<strong>How did this happen ?</strong><br>
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.<br>
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.<br>
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server <br><br>
<strong>What do I do ?</strong><br>
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.<br>
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.<br><br>
<strong>For more specific instructions:</strong><br>
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. <br>
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. <br>
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private softWare with a low price! <br>
<strong>E-MAIL1:</strong> enc4@usa.com<br>
<strong>E-MAIL2:</strong> enc4@dr.com<br>
Spare email if we do not respond within 24 hours:<br>
<strong>E-MAIL1:</strong> enc4r@usa.com<br>
<strong>E-MAIL2:</strong> enc4r@dr.com<br>
<strong>YOUR_ID: 6edc00431c9b74ea</strong>
</div>
</body>
</html>
Emails
enc4@usa.com<br>
enc4@dr.com<br>
enc4r@usa.com<br>
enc4r@dr.com<br>
Extracted
Path
C:\odt\HELP_DECRYPT_YOUR_FILES.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private softWare with a low price!
E-MAIL1: enc4@usa.com
E-MAIL2: enc4@dr.com
Spare email:
E-MAIL1: enc4r@usa.com
E-MAIL2: enc4r@dr.com
YOUR_ID: 6edc00431c9b74ea
Emails
enc4@usa.com
enc4@dr.com
enc4r@usa.com
enc4r@dr.com
Extracted
Path
C:\Users\Admin\Documents\HELP_DECRYPT_YOUR_FILES.HTML
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private softWare with a low price!
E-MAIL1: enc4@usa.com
E-MAIL2: enc4@dr.com
Spare email if we do not respond within 24 hours:
E-MAIL1: enc4r@usa.com
E-MAIL2: enc4r@dr.com
YOUR_ID: 6edc00431c9b74ea
Emails
enc4@usa.com
enc4@dr.com
enc4r@usa.com
enc4r@dr.com
Targets
-
-
Target
Trojan-Ransom.Win32.Snocry.dmv-8f9a62a9e43ed55f0fa810737facc6460dc89c41f16f4d610debc8a35babe6b9
-
Size
84KB
-
MD5
420b2f010edbc63a68b2cce2cdf1e5e9
-
SHA1
4cf5072cfe0eb42d387713067e2706902c89b294
-
SHA256
8f9a62a9e43ed55f0fa810737facc6460dc89c41f16f4d610debc8a35babe6b9
-
SHA512
de85edb0217c3d1e615e81154831fe0f3f7c7514f843f253eecf38da09895558b4dc71c1e4141dd196bda7aa75d2c14c85658355a834f98238370df0bea46f35
-
SSDEEP
1536:cYYxci1ZP39zud52ilpPXvlMq12Kpuyjg1kF3mI:+xFyd52ilpPX6q2y8kF3j
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-