General
-
Target
004cdc6996225f244aef124edc72f90434a872b3d4fa56d5ebc2655473733aef.exe
-
Size
100KB
-
Sample
230706-xh6d1seh9t
-
MD5
a0fed8de59e6f6ce77da7788faef5489
-
SHA1
96ebbf821f37dc2dcebc177fc3a6c17b3171aab3
-
SHA256
004cdc6996225f244aef124edc72f90434a872b3d4fa56d5ebc2655473733aef
-
SHA512
e30357077ba4d61aadf9929c75f74d86898aa17564fd8f40c4f00db6103cd331c619352be4101edfbb89423d20e4f572104684637024303e914e943caee26f8b
-
SSDEEP
1536:SkZzt5HhE73kH54aUEvVqs/PKO97CDkDG2LyeUOKFCDRifOVDYEzJOlHLum6:DLphG5GaO97aMG2+eUO+7iDYEz4V6
Score
10/10
Malware Config
Extracted
Path
C:\HELP_YOUR_FILES.HTML
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>HELP_YOUR_FILES</title>
<style>
.text {
text-align: center;
}
</style>
</head>
<body>
<div class="text">
<strong>NOT YOUR LANGUAGE?</strong> USE <a href="https://translate.google.com">https://translate.google.com</a><br><br>
<strong>What happened to your files ?</strong><br>
All of your files were protected by a strong encryption with RSA-2048.<br>
More information about the encryption keys using RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br><br>
<strong>How did this happen ?</strong><br>
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.<br>
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.<br>
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server <br><br>
<strong>What do I do ?</strong><br>
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.<br>
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.<br><br>
<strong>For more specific instructions:</strong><br>
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 12 hours. <br>
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. <br>
<strong>E-MAIL1:</strong> [email protected]<br>
<strong>E-MAIL2:</strong> [email protected]<br>
<strong>YOUR_ID: ed0e5da01c9b74ea</strong>
</div>
</body>
</html>
Emails
Extracted
Path
C:\$Recycle.Bin\HELP_YOUR_FILES.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 12 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
E-MAIL1: [email protected]
E-MAIL2: [email protected]
YOUR_ID: ed0e5da01c9b74ea
Extracted
Path
C:\PerfLogs\HELP_YOUR_FILES.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 12 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
E-MAIL1: [email protected]
E-MAIL2: [email protected]
Extracted
Path
C:\ProgramData\HELP_YOUR_FILES.HTML
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>HELP_YOUR_FILES</title>
<style>
.text {
text-align: center;
}
</style>
</head>
<body>
<div class="text">
<strong>NOT YOUR LANGUAGE?</strong> USE <a href="https://translate.google.com">https://translate.google.com</a><br><br>
<strong>What happened to your files ?</strong><br>
All of your files were protected by a strong encryption with RSA-2048.<br>
More information about the encryption keys using RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br><br>
<strong>How did this happen ?</strong><br>
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.<br>
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.<br>
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server <br><br>
<strong>What do I do ?</strong><br>
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.<br>
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.<br><br>
<strong>For more specific instructions:</strong><br>
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 12 hours. <br>
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. <br>
<strong>E-MAIL1:</strong> [email protected]<br>
<strong>E-MAIL2:</strong> [email protected]<br>
Emails
Extracted
Path
C:\Users\Admin\Documents\HELP_YOUR_FILES.HTML
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 12 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
E-MAIL1: [email protected]
E-MAIL2: [email protected]
YOUR_ID: ed0e5da01c9b74ea
Targets
-
-
Target
004cdc6996225f244aef124edc72f90434a872b3d4fa56d5ebc2655473733aef.exe
-
Size
100KB
-
MD5
a0fed8de59e6f6ce77da7788faef5489
-
SHA1
96ebbf821f37dc2dcebc177fc3a6c17b3171aab3
-
SHA256
004cdc6996225f244aef124edc72f90434a872b3d4fa56d5ebc2655473733aef
-
SHA512
e30357077ba4d61aadf9929c75f74d86898aa17564fd8f40c4f00db6103cd331c619352be4101edfbb89423d20e4f572104684637024303e914e943caee26f8b
-
SSDEEP
1536:SkZzt5HhE73kH54aUEvVqs/PKO97CDkDG2LyeUOKFCDRifOVDYEzJOlHLum6:DLphG5GaO97aMG2+eUO+7iDYEz4V6
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-