6ad193d16ad5cd7426369e29a47dc02df6e40762c84d58281d24fe6b77799714

General

Target

ad607f046a6f855f06d0e7b2cab189c1.bin
Size

254KB
Sample

230719-chqcksfh31
MD5

782c8c8c6d54ee7f3d6d9773b3c1947f
SHA1

6b724ecec1175875e250d1c9d9c1e898ef62bdfe
SHA256

6ad193d16ad5cd7426369e29a47dc02df6e40762c84d58281d24fe6b77799714
SHA512

66de67c497df48821ab28285c23874160ec37475ab27ae23cc7422526f1ce67ee5cb0f706ae3e8c9793960a83678b6dc48ae85363ce12470ed9076c7816bb9ea
SSDEEP

6144:eVb1PMim55/mWOarwXraXw7yZzJKKhDh2vI3LwgZ:y5vmH/Y8wX+3VJKK10ARZ

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\FILE RECOVERY.txt

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 692DE69339ECDE3CFDD511E1 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

- Target
  
  552719d9dda2789ec880ab52ba8c7e695b631d6fab6d56474b4b6a4f8fe4c21e.exe
- Size
  
  387KB
- MD5
  
  ad607f046a6f855f06d0e7b2cab189c1
- SHA1
  
  99a3416dea0f6eb2900c17b50ff171b15386e8bb
- SHA256
  
  552719d9dda2789ec880ab52ba8c7e695b631d6fab6d56474b4b6a4f8fe4c21e
- SHA512
  
  ca5edac411c12129debd510dcbb59cdea56adcc68c006410cbb7550ff520285eddcf4b6108ae78e40197850dd5f10adddc18b9c43c8c78f83602f4d2a6eed478
- SSDEEP
  
  6144:VZVgqnvYmMKNLgYApEBQh9jToGZaFROm7kv6KreTqH6F:VZ+qnwSg/ECh9jTH3iGreTjF
Score

10^/10

discovery evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (3593) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2