e6e689c5fbcc757bc0ecc60559909078e73baaba9d6727111651626c12bed436

General

Target

m2.ex
Size

2.0MB
Sample

230518-ym8klscf4z
MD5

b4d346055c102520ea0250509129a392
SHA1

65efdd0c5fb90f184f04a093d9c59c3884069d6f
SHA256

e6e689c5fbcc757bc0ecc60559909078e73baaba9d6727111651626c12bed436
SHA512

df2ff054acacb6eebb9aaf7ccc72de9cfb1b589bf359d86e567a1742f4b917918a7dc47d566cf3103ace2876a8451d1f43719d063030b806b59a4f1ec438f324
SSDEEP

24576:dmwhvK6K6lv3szLwGskVdHJ+GQOq8GV2wlC/mhKQG/HsQaUK6A+jg0:IwcM3CtifKQGLFs

Score

10^/10

evasion ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\FILE RECOVERY.txt

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 99B35098F23ECB8E74609337 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Extracted

Path

C:\Program Files\7-Zip\Lang\FILE RECOVERY.txt

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 619260DC0FE91E376D459B1D 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

- Target
  
  m2.ex
- Size
  
  2.0MB
- MD5
  
  b4d346055c102520ea0250509129a392
- SHA1
  
  65efdd0c5fb90f184f04a093d9c59c3884069d6f
- SHA256
  
  e6e689c5fbcc757bc0ecc60559909078e73baaba9d6727111651626c12bed436
- SHA512
  
  df2ff054acacb6eebb9aaf7ccc72de9cfb1b589bf359d86e567a1742f4b917918a7dc47d566cf3103ace2876a8451d1f43719d063030b806b59a4f1ec438f324
- SSDEEP
  
  24576:dmwhvK6K6lv3szLwGskVdHJ+GQOq8GV2wlC/mhKQG/HsQaUK6A+jg0:IwcM3CtifKQGLFs
Score

10^/10

evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (2249) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies service settings
  Alters the configuration of existing services.
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2