eedda61d02d8bd0e145a07e6048621fc84f420376e6cda2616c2d77d4fd4fe18

General

Target

1.bin
Size

1.8MB
Sample

230829-q5j1zacg84
MD5

212e77d39264b02290a97c25d692f746
SHA1

6adf30be27fe42380ff57caa8bb1c2b955586941
SHA256

eedda61d02d8bd0e145a07e6048621fc84f420376e6cda2616c2d77d4fd4fe18
SHA512

26207731be09241bedc6804f4620c6f132e92c9b4246e12cb9ae3d89ba912b9394a1d6644141154b1b2eb931d365a6aeb1cad37220a60ed4c953e32bffe4a11f
SSDEEP

24576:ZucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlFxBkTde/cfkOg:ZucUS55cHgJIzez8+n9Bn3NTlBkYokOg

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\How To Restore Your Files.txt

Ransom Note

All your documents, company files, images, etc (and there are a lot of company data) have been encrypted and the extension has been changed to .knight_l . The recovery is only possible with our help. US $14123 in Bitcoin is the price for restoring all of your data. This is the average monthly wage for 1 employee in your company. So don't even think about negotiating. That would only be a waste of time and you will be ignored. Send the Bitcoin to this wallet:13oUavxdk3WEyYbMezT6K1H7X2gWH5MAxu (This is your only payment address, please don't pay BTC to other than this or you won't be able to get it decrypted!) After completing the Bitcoin transaction, send an email at: http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/c8c30be6-dbd5-44d5-b431-ba5aaa7e5e8b/ (Download and install TOR Browser (https://www.torproject.org/).[If you don't know how to use it, do a Google search!]).You will get an answer as soon as possible. I expect a message from you with the transfer of BTC Confirmation (TXID). So we can move forward to decrypt all your data. TXID is very important because it will help us identify your payment and connect it to your encrypted data.Do not use that I am here to waste mine or your time. How to buy the BTC? https://www.binance.com/en/how-to-buy/bitcoin https://www.coinbase.com/how-to-buy/bitcoin Note: Your data are uploaded to our servers before being encrypted, Everything related to your business (customer data, POS Data, documents related to your orders and delivery, and others). If you do not contact us and do not confirm the payment within 4 days, we will move forward and will announce the sales of the extracted data. ID:a1c71d2236d0ad87e613d1cdb929d4863c19e4cc45f2116abf80ed4aa0dec90e

URLs

http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/c8c30be6-dbd5-44d5-b431-ba5aaa7e5e8b/

https://www.binance.com/en/how-to-buy/bitcoin

Targets

- Target
  
  1.bin
- Size
  
  1.8MB
- MD5
  
  212e77d39264b02290a97c25d692f746
- SHA1
  
  6adf30be27fe42380ff57caa8bb1c2b955586941
- SHA256
  
  eedda61d02d8bd0e145a07e6048621fc84f420376e6cda2616c2d77d4fd4fe18
- SHA512
  
  26207731be09241bedc6804f4620c6f132e92c9b4246e12cb9ae3d89ba912b9394a1d6644141154b1b2eb931d365a6aeb1cad37220a60ed4c953e32bffe4a11f
- SSDEEP
  
  24576:ZucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlFxBkTde/cfkOg:ZucUS55cHgJIzez8+n9Bn3NTlBkYokOg
Score

10^/10

ransomware
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Renames multiple (159) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2