xorist | 4f420670cf9767116e29cec9ea7188372f98f335b4356ee4e5eb19357659bd8e

General

Target

4f420670cf9767116e29cec9ea7188372f98f335b4356ee4e5eb19357659bd8e
Size

52KB
Sample

230614-2sjefsea6z
MD5

48b02fdd57c03614980adebff3667758
SHA1

08bf32f9396c25e42e12c9c597464c250f27b40c
SHA256

4f420670cf9767116e29cec9ea7188372f98f335b4356ee4e5eb19357659bd8e
SHA512

1f666c53a6e116531897ddbf4352373002014ae47cf28a18bc7025d306143f43f948eb3c9df202259d36ad30a2947c652f06578f47e317ec6d7a08ca19c174bf
SSDEEP

768:I0FmBkpKjJH40wpb0v8igE9lvh6P72uUtJ74s8aRjY0t/JwMjHrzqhLtIsDs5V:IODvlc8iTxa6uUtp75PjHvqdIT

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Ransom Note

You have become a victim of the TmrCrypt0r ransomware! What happened to my computer? All your important files are encrypted. Many of your documents, archives, photos, videos, music, databases and other files have been encrypted. You may be busy looking for a way to recover your files, but don't waste your time. No one can recover your files without our decryption service! Is it possible to restore files? Sure. We guarantee that you will be able to recover all your files easily and safely. But you don't have much time. You have only 3 days to send the payment, after that time the program will not be able to request access to the necessary utility descriptor. How do I pay? Payment is accepted exclusively through the Yoomoney wallet, the wallet number will be indicated below. The price of file redemption is $ 150 (in rubles). Once again, we remind you, everything is serious. Do not touch or change the configuration of your computer. Please read this notice carefully as you will not see it again the next

Targets

- Target
  
  4f420670cf9767116e29cec9ea7188372f98f335b4356ee4e5eb19357659bd8e
- Size
  
  52KB
- MD5
  
  48b02fdd57c03614980adebff3667758
- SHA1
  
  08bf32f9396c25e42e12c9c597464c250f27b40c
- SHA256
  
  4f420670cf9767116e29cec9ea7188372f98f335b4356ee4e5eb19357659bd8e
- SHA512
  
  1f666c53a6e116531897ddbf4352373002014ae47cf28a18bc7025d306143f43f948eb3c9df202259d36ad30a2947c652f06578f47e317ec6d7a08ca19c174bf
- SSDEEP
  
  768:I0FmBkpKjJH40wpb0v8igE9lvh6P72uUtJ74s8aRjY0t/JwMjHrzqhLtIsDs5V:IODvlc8iTxa6uUtp75PjHvqdIT
Score

10^/10

persistence ransomware spyware stealer
- Renames multiple (2141) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1