55e93dfebde154676d9f693e2573060366412110e6a7f05088c83b3f40e9a6c1

General

Target
nnll.zip
Size 407KB
Sample230915-hyserscb44
SHA256 55e93dfebde154676d9f693e2573060366412110e6a7f05088c83b3f40e9a6c1
MD5 0effd613adf3a4ee0490f2a72ed1f596
SHA1 f1f9f211fbdc0f9c9e9bc1e51ea06101e3b6bb37
SHA512 28ab3826a197bea8e64f807e1a008c16ea572c7468d47b559a65737448362951a5e602e11fca4efa9f7126a152ce1bb0cfa8e3654e8dc3c1d75ba8bf4cc24d48
SSDEEP 6144:t2gRfMKJ4bKjZbedvYS/VPvDTiLgsORPn0+jiTUO9HwLMGxa9BWBLq7Z0hzbg:MUkm1S/Vv4ORPEhVUdhB4ShzU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\_Readme.txt

Ransom Note

ATTENTION! Don’t worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-O0PCajl3M8 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that’s price for you is $490. Please note that you’ll never restore your data without payment. Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: MiSaTZHPPplfJNOCRxgwTxrFECe0aRRHv1dkGY1h

Emails

URLs

https://we.tl/t-O0PCajl3M8

Targets

- Target
  decryp.exe
- Size 18KB
- SHA256 24d8b33ffceaa0cee17a6258d39be1317672fc481c889822cf38963e3eb488c2
- MD5 0bddede8897d9d810f34d4eab1f6f07a
- SHA1 b0b74c8a73699f93915154826ba8cfebe92c1dd4
- SHA512 ae2e6cd9495b54c6fc9c4c27ece37bf0719bf42bd9c5bba4a29782f50d127d6a32461a405d9014b311e9de51d0ffc7c6001f9dbcdbbde94a92a2c51e661fe1fa
- SSDEEP 384:3G1LKciD3h+fRSsBS9UpM8WefjHYc0wu:3G1LK1/sBS978/fTYc0wu
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1
- Target
  nnll.exe
- Size 917KB
- SHA256 dd595da7ed62a415d319d4903c62312bf52e10603b54c2051b45c6ca955606a3
- MD5 bd5c08142cf5d80157242c950ef85e62
- SHA1 7b4657f833fd25f579bfc49abc42ac16e9bff697
- SHA512 c48b348cc9e606622a259cf6fa18f975866ab36036b546fe92551a3ae4bd510e2baf64a4cbdf4b7c09fc6f3f7b9fa949847d92766bd9d0261b0517d0b8d9c9db
- SSDEEP 24576:o8m657w6ZBLmkitKqBCjC0PDgM5AH5DT+j:MVV1BCjBEDT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

evasion persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral2