df430ab9f5084a3e62a6c97c6c6279f2461618f038832305057c51b441c648d9

General

Target

JC_df430ab9f5084a3e62a6c97c6c6279f2461618f038832305057c51b441c648d9
Size

2.2MB
Sample

230901-ykbsvshf62
MD5

84820f3eb491a2fde1f52435cd29646c
SHA1

8c6e135495fcf8898de62e6793e3cd06d3025461
SHA256

df430ab9f5084a3e62a6c97c6c6279f2461618f038832305057c51b441c648d9
SHA512

68d01c2baf9240c3f117acf211f7d253cbe37c2ccdf22ec0688607d35f7f5fb29e9f0aa0f0d9e60363333238028be1f3ca2b774ea8eed4df52fe4417eb27faae
SSDEEP

24576:8J/+56Kus0jCcT8kgTe5Gq10TgoFf25QVDGxkl2JM6ioM93gBFfMEzNiYlg055Ws:8pFg0MYq+W249vZGqsCz9/K7E8gx1z1

Score

10^/10

evasion ransomware

Malware Config

Extracted

Path

C:\Program Files\Common Files\System\Ole DB\de-DE\README_TO_DECRYPT.txt

Ransom Note

Your network has been compromised! All your important data has been encrypted! There is only one way to get your data back to normal: 1. Contact us as soon as possible to avoid damages and losses from your business. 2. Send to us any encrypted file of your choice and your personal key. 3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files. 4. Pay the amount required in order to restore your network back to normal. 5. We will then send you our software to decrypt and will guide you through the whole restoration of your network. We prefer Monero (XMR) - FIXED PRICE We accept Bitcoin (BTC) - 20% extra of total payment! ============================================================================================================================ WARNING! Do not rename encrypted data. Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover. ============================================================================================================================ Contact information: In order to contact us, download with the following software: https://qtox.github.io or https://tox.chat/download.html Then just add us in TOX: D27A7B3711CD1442A8FAC19BB5780FF291101F6286A62AD21E5F7F08BD5F5F1B9803AAC6ECF9 If there is any problems setting up TOX then just write to us at the following mail, it will only apply for problems setting up TOX and contacting us through TOX: [email protected] ============================================================================================================================ Your personal id: 5253413d62646666316237316165626463623239303561656339646362373735336561613a303761363761373734653934383831366435363463663034653033633363623163366332396637386162333432303730643635346537363365383033366237663737303033383735373132326666626565333130613565646231653638653765633936366238636338663732646233646333623630353436333466623339346261343139656633323364353163633236323761323830313565313834656133316339666266313535333765366434303132393965366234353563396238663639366338353731366230636566313234393464633861646637306132353866343761313366386366626135333965613665373836363239636137323234613935373738383633353063653637323439663463616366326131653830653530366231363136383937613465376233356564323366396532616436643362343066383966363964373065313731636431623736646634386465333765376634623336336439346465633364626361373235383734323561326565326532316664623631386337316538353265343838393662323833363833643030323961616161653033663064646432306530323965333532383538376264316135363731663161643564343733323239353833336461353963656635633931356435343032666336323734613561656330653465356230326462666464646163653032323431663161353532343032353134333736303338306631383238356134306635363937393861633335353536663234343764363835663335323137306366356630323439363936653230363031633239613962626631383434666365373331653663353131323237343066373665313735393836643964313939333136333435643165366634616362383539326339326262643238363036383638656261303964383639643436336562663661333964636566333933333131633565356138653737373336633539633530376536346665323231626261336234373763343939303036306230623962613664383830376230663135633537613339636639333766613533653038656238653732656430653832383964666639656161646234386131363666366530646136653763623564623136653432346336623432623734306565373463303431356537613932303631613162663163616238336332653733333366313330396634336538376436363464333566313337386264323064343136666534303432343963393634613861333235326663633232616266643332316465353031343236373764623065616539363133326433393365653439633131643862303238356664323764633937363762316362383632386134303731356665323235373232303164633436383031623630356332393237616531383937376132333a62306333383762363833663566333861663831323239303564633732633363613536666330656136306137646233396139373238323530376636656334663564626264653232636662613431616164313564623236653462663832393536616262313738633866646338373634656566653864626238363863343638613561376337636166663762313261633032313638313934663432373131636233366163356164626139303531366366356130616437393430623232326531656164383733383665653765626235636535336466623565653662353436646562646561383461316362626434303537646363623231613033363239623830623034363434303535343564633336303664623435333334323238323539616265353531336231303964656232303761653461633837653234393065663139393730323763363739366164623765623332643039306365666665343166353665326566306632386238313638633031323364646266666635643466353663346461313132326662616335353732386233313734656266633930313235653930333262393361663630373336623137323437643564353238646562626338633436633664323134333661623934376436393861396462393862363430353436343637353266353439326639383634356465323430663636396539393934313232356163393466333962623435656165656439393938343330363334323539636632663062343435653735653865643835623561393938636633336637656164626438356434616436653665333561613538616236663935393639663833643864616163383763396534373665396464623764643264353730653638643664333764613730396636643064363736303863343833326135383963313639623434646132393061666532303738313939643232333839303763306138643837623564353631383131393439356235656536336233366639623632373566373130303531663861616266626263613532626535386530376536316436623738653562666333326462356434353366343864616163353562643237313332333237643162343238383837343234636334663830393039333034313134663031323739643134643638343838663431326363646137306339616230303036336662323535333534653466663261316139383239346136396339626137346335323634646666613365643034373732646233336238646162346335303763353466353565386635323663386261643364343239363636396661666131656662343864383932653865656538633337316235396161663533626462303631646264343235383631313336653537613438376530383938636364323634323433363734373835666636333764393136

Emails

[email protected]

URLs

https://qtox.github.io

https://tox.chat/download.html

Targets

- Target
  
  JC_df430ab9f5084a3e62a6c97c6c6279f2461618f038832305057c51b441c648d9
- Size
  
  2.2MB
- MD5
  
  84820f3eb491a2fde1f52435cd29646c
- SHA1
  
  8c6e135495fcf8898de62e6793e3cd06d3025461
- SHA256
  
  df430ab9f5084a3e62a6c97c6c6279f2461618f038832305057c51b441c648d9
- SHA512
  
  68d01c2baf9240c3f117acf211f7d253cbe37c2ccdf22ec0688607d35f7f5fb29e9f0aa0f0d9e60363333238028be1f3ca2b774ea8eed4df52fe4417eb27faae
- SSDEEP
  
  24576:8J/+56Kus0jCcT8kgTe5Gq10TgoFf25QVDGxkl2JM6ioM93gBFfMEzNiYlg055Ws:8pFg0MYq+W249vZGqsCz9/K7E8gx1z1
Score

10^/10

evasion ransomware
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (113) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

3

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Tasks

Sharing

General

Malware Config

Extracted

Targets

Clears Windows event logs

Deletes shadow copies

Renames multiple (113) files with added filename extension

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2