dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408

Target
92.exe
Size 1.3MB
Sample230903-mk4yvshe79
SHA256 dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408
MD5 7defc0b43aa2ad389575df2419b7909b
SHA1 cf0dd52331ce203c723f7be32bd91d7cfb34a988
SHA512 9291bc529ce05bc4d0f0e464e008023ca8d310beeca0cbf47b21239423607f5944ed446d9e99537c49cf637a1aed3b55a96277f327bc4d8eb8908b400d8c2573
SSDEEP 12288:0BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPzouMA+nkGGCp+ME:tTcCG0447AMVgfdnTClVm4QzcGRGS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\How To Restore Your Files.txt

Ransom Note

All your documents, company files, images, etc (and there are a lot of company data) have been encrypted and the extension has been changed to .knight_l . The recovery is only possible with our help. US $14508 in Bitcoin is the price for restoring all of your data. This is the average monthly wage for 1 employee in your company. So don't even think about negotiating. That would only be a waste of time and you will be ignored. Send the Bitcoin to this wallet:1HRgvL5tQreF55wzLNP9g7NV2MoRuugoDE (This is your only payment address, please don't pay BTC to other than this or you won't be able to get it decrypted!) After completing the Bitcoin transaction, send an email at: http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/f6e2d5b5-775a-4cca-a4d2-44d6891c3e42/ (Download and install TOR Browser (https://www.torproject.org/).[If you don't know how to use it, do a Google search!]).You will get an answer as soon as possible. I expect a message from you with the transfer of BTC Confirmation (TXID). So we can move forward to decrypt all your data. TXID is very important because it will help us identify your payment and connect it to your encrypted data.Do not use that I am here to waste mine or your time. How to buy the BTC? https://www.binance.com/en/how-to-buy/bitcoin https://www.coinbase.com/how-to-buy/bitcoin Note: Your data are uploaded to our servers before being encrypted, Everything related to your business (customer data, POS Data, documents related to your orders and delivery, and others). If you do not contact us and do not confirm the payment within 4 days, we will move forward and will announce the sales of the extracted data. ID:bb9d2cfddf0d8666d33c9c087493ddda3fd22c3cb30809a99df0f13b7140cc66

URLs

http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/f6e2d5b5-775a-4cca-a4d2-44d6891c3e42/
https://www.binance.com/en/how-to-buy/bitcoin

Targets

- Target
  92.exe
- Size 1.3MB
- SHA256 dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408
- MD5 7defc0b43aa2ad389575df2419b7909b
- SHA1 cf0dd52331ce203c723f7be32bd91d7cfb34a988
- SHA512 9291bc529ce05bc4d0f0e464e008023ca8d310beeca0cbf47b21239423607f5944ed446d9e99537c49cf637a1aed3b55a96277f327bc4d8eb8908b400d8c2573
- SSDEEP 12288:0BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPzouMA+nkGGCp+ME:tTcCG0447AMVgfdnTClVm4QzcGRGS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ransomware
- Renames multiple (135) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1