dd595da7ed62a415d319d4903c62312bf52e10603b54c2051b45c6ca955606a3

General

Target

nnll.exe
Size

917KB
Sample

230918-v2qfssdd74
MD5

bd5c08142cf5d80157242c950ef85e62
SHA1

7b4657f833fd25f579bfc49abc42ac16e9bff697
SHA256

dd595da7ed62a415d319d4903c62312bf52e10603b54c2051b45c6ca955606a3
SHA512

c48b348cc9e606622a259cf6fa18f975866ab36036b546fe92551a3ae4bd510e2baf64a4cbdf4b7c09fc6f3f7b9fa949847d92766bd9d0261b0517d0b8d9c9db
SSDEEP

24576:o8m657w6ZBLmkitKqBCjC0PDgM5AH5DT+j:MVV1BCjBEDT

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\_Readme.txt

Ransom Note

ATTENTION! Don’t worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-O0PCajl3M8 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that’s price for you is $490. Please note that you’ll never restore your data without payment. Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: STHqZbUCFbdCjfPuBkwrrKbO5skGMKrnyN44WrgI

Emails

[email protected]

URLs

https://we.tl/t-O0PCajl3M8

Extracted

Path

C:\Users\Admin\Downloads\_Readme.txt

Ransom Note

ATTENTION! Don’t worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-O0PCajl3M8 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that’s price for you is $490. Please note that you’ll never restore your data without payment. Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: n5XFQsJlZwoxavAndXp1rNnyrlKvAyYjUYv@Bi5P

Emails

[email protected]

URLs

https://we.tl/t-O0PCajl3M8

Targets

- Target
  
  nnll.exe
- Size
  
  917KB
- MD5
  
  bd5c08142cf5d80157242c950ef85e62
- SHA1
  
  7b4657f833fd25f579bfc49abc42ac16e9bff697
- SHA256
  
  dd595da7ed62a415d319d4903c62312bf52e10603b54c2051b45c6ca955606a3
- SHA512
  
  c48b348cc9e606622a259cf6fa18f975866ab36036b546fe92551a3ae4bd510e2baf64a4cbdf4b7c09fc6f3f7b9fa949847d92766bd9d0261b0517d0b8d9c9db
- SSDEEP
  
  24576:o8m657w6ZBLmkitKqBCjC0PDgM5AH5DT+j:MVV1BCjBEDT
Score

10^/10

evasion persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2