d15f12a7cf2e8ec3d6fceabfab64956c7e727caab91cff9c664f92b5c8552570

General

Target

bozon.bin
Size

143KB
Sample

230515-vtzz9sgf44
MD5

11430f9bdbb02c4e3002377210c0caa2
SHA1

6a461c4f2487f2fc39a1d059096de661bd691057
SHA256

d15f12a7cf2e8ec3d6fceabfab64956c7e727caab91cff9c664f92b5c8552570
SHA512

816b251cfc1d606a6c4ce06f05cb4e04e6b7a583aae71f45366d7ae562f0ea25e86a3e95f424adae537ffe24285cda41e6354dc676c4e7bcb3c79119f3131703
SSDEEP

3072:CpcIVBnt8M20Iy0gqmATzLt71I8N3dDryx33M2NbcLSLJxhX9cJDK:CpcUt8M2fHmALHj3InvpKJD

Score

10^/10

evasion ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\FILE RECOVERY.txt

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 209EFC2570D82E5BEE1D6B1B 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

- Target
  
  bozon.bin
- Size
  
  143KB
- MD5
  
  11430f9bdbb02c4e3002377210c0caa2
- SHA1
  
  6a461c4f2487f2fc39a1d059096de661bd691057
- SHA256
  
  d15f12a7cf2e8ec3d6fceabfab64956c7e727caab91cff9c664f92b5c8552570
- SHA512
  
  816b251cfc1d606a6c4ce06f05cb4e04e6b7a583aae71f45366d7ae562f0ea25e86a3e95f424adae537ffe24285cda41e6354dc676c4e7bcb3c79119f3131703
- SSDEEP
  
  3072:CpcIVBnt8M20Iy0gqmATzLt71I8N3dDryx33M2NbcLSLJxhX9cJDK:CpcUt8M2fHmALHj3InvpKJD
Score

10^/10

evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Stops running service(s)
  evasion
- Deletes itself
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2