General

  • Target

    dsygrqdf.exe

  • Size

    192KB

  • Sample

    230516-z9t66sbg5x

  • MD5

    b96329e44c5b6261eda4786221c1ea2c

  • SHA1

    ae109ee47381826501f6eae35c9f9b4d1ecdcd25

  • SHA256

    69df825ccb14f20f8e25b73542611d17313cb03e2e49ab44f1ee9d26a124a98a

  • SHA512

    fd31a0fd685ffc9ec56a6e53c4c67a8fba75cc50e061922f6f86dc81fdba2159d5171885bde4504a41922a08bf2df6718ac4212df021f1a38436691300667e3d

  • SSDEEP

    3072:hzqT24OB8Xjr0N5rlgQB836w8VWbikeNfGmGooGB+DMpKlGQT+3W2WWj:hzqhO2Twrd/WmDNXoG+MolGJ5fj

Score
10/10

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Analysis Services\WE CAN RECOVER YOUR DATA.TXT

Ransom Note
HELLO ! NI HAO ! OLA ! CAN I DECRYPT MY FILES ? YES. SURE. We guarantee that you can recover all of your data easily!. We are give you full instruction. And help you untill decryption process is fully finished. CONTACT US: Download the (Session) messenger (https://getsession.org) in messenger :" 052f479149654b80c12357da3139cd78d308ad9880e9e7dd4fbb12890b66aeb55d " You have to add this Id and we will complete our converstion. You have to pay for decryption BITCOIN ONLY! !!! ATTENTION !!! IF YOU WILL CONTACT DATA RECOVER COMPANY THEY WILL WASTE YOUR TIME AND TRY TO GET MONEY FROM YOU, than they will try to contact us and try got money from 2 sides (So waste your and our time). REMEMBER !!!! This money will be from your pocket any way. We can give you 1 - 2 encrypted files not big , NOT VALUE, for test (You send us encrypted we send you back decrypted data). You data encrypted and only WE ARE have decryption key.(To decrypt your data you need just 30 min, after payment, no more than ! ! ! ) Do not rename encrypted files, do not try to decrypt your data by using third party software, it may permanent data loss. We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. You have 24 hours to contact us. Otherwise, your data will be sold or made public.
URLs

https://getsession.org

Targets

    • Target

      dsygrqdf.exe

    • Size

      192KB

    • MD5

      b96329e44c5b6261eda4786221c1ea2c

    • SHA1

      ae109ee47381826501f6eae35c9f9b4d1ecdcd25

    • SHA256

      69df825ccb14f20f8e25b73542611d17313cb03e2e49ab44f1ee9d26a124a98a

    • SHA512

      fd31a0fd685ffc9ec56a6e53c4c67a8fba75cc50e061922f6f86dc81fdba2159d5171885bde4504a41922a08bf2df6718ac4212df021f1a38436691300667e3d

    • SSDEEP

      3072:hzqT24OB8Xjr0N5rlgQB836w8VWbikeNfGmGooGB+DMpKlGQT+3W2WWj:hzqhO2Twrd/WmDNXoG+MolGJ5fj

    Score
    10/10
    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks