4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41

General

Target

4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41.exe
Size

149KB
Sample

231012-txhpqabb9t
MD5

7328af3a365df9561a55e86421fb81c0
SHA1

6cfb5b4a68100678d95270e3d188572a30abd568
SHA256

4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41
SHA512

d36bc6ff51047aecacbafd92af6581e766d9b38720c5d9443f96a58e213c33a50291d578b18dc77f9b6977eaae712764aa0b49da82c0a9e3fb264e93b0033369
SSDEEP

3072:kudyVkuftDR6PhpKHxf09vLOn8LlB9MJ:kyVzpKHxfkv1l

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Read Me.Hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>[email protected]</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language="JScript"> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type="text/css"> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </hta:application></p> <div class="header"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII=" /> <h2><span style="text-decoration: underline; color: #000000;"><strong><em>All your files have been encrypted!</em></strong></span></h2> </div> <div class="bold">All your files have been encrypted due to a security problem with your PC.</div> <div class="bold">If you want to restore them, write us to the e-mails: <span style="color: #800000;"><a style="color: #800000;" href="mailto:[email protected]">[email protected]</a></span> and <span style="color: #ff0000;"><a style="color: #0000ff;" href="mailto:[email protected]">[email protected] </a></span> and <span style="color: #800000;"><a style="color: #006400;" href="mailto:[email protected]">[email protected]</a></span><span style="text-decoration: underline;"></span></div> <p>(for the fastest possible response, write to all 3 mails at once!)</p> <h4 class="bold"><span style="text-decoration: underline;"><em><strong>Write this ID at the beginning of your message:</strong></em></span></h4> <p><span style="text-decoration: underline; color: #0000ff;"><em><strong>C29983C6BD07A539AD8688E89E625D4C2EE5B7ADD0288E2776875DC107744D 2095D6529364B61DD287B10AB81C9E77F4940409133E3F85AAE7F74FEAC045 74F062FE0715821BBB2E8D2285B6FF2DB0C34BFACB84C0DF788CA106CE64B0 6312CBFAF83F1FC029EE58B2B0D1EB468AF5EB7E966B3FFFD45B75C7102B2B 3D1AF1CADE0221BE6EE7B37413560CE0A29D447B6EDB402D21374758FF40A2 168924FE89C42F678698E48135473772985A7F7011BB8D0C8A456E35D29D1B 6261CEFDB904D9D044AF4C3751B4736A4568CDD3A90655FBD8FE9C0D67C11D 45EDDE5655C0C702B447562C02E6623825210F549955ED5D8F5C5996AFBF42 698721E69B77CAB548AD6A58C732FB9B92914B7FAF9EDEB7CA89CFDBD93614 3F6CEBDA10A1D7561769BE1EBF21D891C4602CA1719D400CE1256A4F815054 33E59E1136CFA66003D24A1DE418E427C7B825C774AB65E2C5F88E6171F781 D0A249BA7F7E1052BA7461B4BFCAC1435246DA91DB9A9667DD575BF90F3BA0 04A9041966AC635A7E38FE97B6D252F50573DE1F39A46CDDF0484B4BC7BAEA 1D73AA634104F3E03DDA9D0890D8A34A15DCC02527F05CDE699A64A577E040 68278093A6012EC9E0CB69EA85DE77DFC395793913DABED2612CEDD5E16297 843E48E2AF54D3E7D59A2B83EB23A3A620907E716F5838F4F46FD2AE467FC7 6BBF49DCEDF55DD6AE33D05577AF9887D1B78F2824C77205682242F195B9A1 603A3BE368750F0EC63D58330DA17F809BFB41694BA9CAC6011E6DFF1D1432 C96E1C9CBA40C8262C650E6A04F5296C5298B18CF4640236D4B04A5EED836E 9FE2B5DEAE73436938DFDAD54CFB3149ABD64382AACA209DAD19DADB3E785B 5602D5BD80EB999049733699E222664E6410BFF82F845E5093B49B77CBB6E6 5418DC1495A836140B8F1AFA604591AF2BDA648A2B38E5B37D9F4F88E83CBC 6AED6EC9CA4FA573CC07DC441B027C1FD3EBB6366DF44F19A905A6E64DBC7A AE56E015A7D25117E8D21ABBCDC46F25E4B7B04EA695DAC8F4934596050E0B AE798C9CB24D38A0EF8C30F04A1A5F967657508342D03B0707AFC70F6B47B6 543E99B9D55A10CFD4B2C7D037DD2C593F26577C1BE581B715961D36B35981 E401 </strong></em></span></p> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 5Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

Emails

<title>[email protected]</title>

href="mailto:[email protected]">[email protected]</a></span> and <span

href="mailto:[email protected]">[email protected]

href="mailto:[email protected]">[email protected]</a></span><span

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

C:\Read Me.Hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>[email protected]</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language="JScript"> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type="text/css"> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </hta:application></p> <div class="header"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII=" /> <h2><span style="text-decoration: underline; color: #000000;"><strong><em>All your files have been encrypted!</em></strong></span></h2> </div> <div class="bold">All your files have been encrypted due to a security problem with your PC.</div> <div class="bold">If you want to restore them, write us to the e-mails: <span style="color: #800000;"><a style="color: #800000;" href="mailto:[email protected]">[email protected]</a></span> and <span style="color: #ff0000;"><a style="color: #0000ff;" href="mailto:[email protected]">[email protected] </a></span> and <span style="color: #800000;"><a style="color: #006400;" href="mailto:[email protected]">[email protected]</a></span><span style="text-decoration: underline;"></span></div> <p>(for the fastest possible response, write to all 3 mails at once!)</p> <h4 class="bold"><span style="text-decoration: underline;"><em><strong>Write this ID at the beginning of your message:</strong></em></span></h4> <p><span style="text-decoration: underline; color: #0000ff;"><em><strong>9F8DEEE9F4149D8F523FE38011372C76EB9D1EA53A2491B113B89F342EF21D EC4533CDA0ADC23BB056C2FCFDE66CCF38EB4863846EC039012C262D9F7FB6 3171D7B5F60E90F93F9603155B97C2976DE11A2458725E7F392CB37F3D94DC 49133B044A24C31304BBBB20C3A0BAF25DAD85FBFB07846DF8B6989114A928 2A28362B911664FDDBD2840AD1B0147BD9ECEB4E4F677E2BA3B5DB467A63F8 77F6693D6233A2E60D04F00B3342AAE73BFA04515F03C3F7D1EF95C72E4F55 5B2537233441F2C2382EC900C07B06D0EC63E3401CFC99302E3C853EC3D1DF 6B32D06308859549AAB40F4E3B2455246CBFCEDA7CA3BE9EF79435BBE577E6 D16EEB21F8686F2ED8D028B75FDB2EC7A41E6CC1B563F789286DC51576A07C AF7C918EF36AFEC72DEB5362C141B06A187AD1784828AD0ED319711E07E7D6 D5188CE1EEF45AFF3EFF80EE638A43EBC2B79E8B0BA084506FA220674F2316 4567DCDCC443D013C769B4C5819AD068DBFD560BA7FACE9E7B1962479AAC8B 5F1521EE59F439D3732C00D8C964FD0D1F2D4ABC48ECE2437862155CADA065 90C5BB858FB34B45663E4D828134BDBBA19D27BFD7AEC5DE2C9054BCBF65AD 30CC2A7DD53F85EA67CC3185E3A0CA59F2A93EC42C6D6DA6E6B617D9FBC5EC CE5791A0830227B020C61CBB19907881EA3B4F8DD55333FA6D4616082F02A5 6EEEBB37E6E517A144DBA4009D56C66C2B5172459C5C8F25A6CBADE161DAD8 A085B27C16FFFB259FB27CE413E6D3CA0B1533952499F7FDD92DED0B4D9B88 3E15C12D4C33E266EC9A995E424D6240AFE911E394ABF02DA0970B93740587 C5E1A5F2882AFD655934A9A19AC728D01296A79CB05CA86B6426DB93DF32A4 E34C8D6B56F4D4591047549A02945E8BD5224D936AA0DF5F840476ECBD423A 9CC7E052D3CCA874D28132ED3A74DCB2BA21C36404419EB49ABFA1F945BE33 CB70DAF61D637D2A5672367192672E1F56661DA9E17EB6038BC740E2843619 787A17EE629FC1136354140226C6654572213E97248F7841EEE37311723BC7 3EA6A4945CA1B0CB4B59F42E2E9ED4C15C92E460C769D71AF471DE1F8CC799 4794E9C2166B28217E3D0D1BB061D55CC03F72FE00968B5E108A04A1B31061 5D01 </strong></em></span></p> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 5Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

Emails

<title>[email protected]</title>

href="mailto:[email protected]">[email protected]</a></span> and <span

href="mailto:[email protected]">[email protected]

href="mailto:[email protected]">[email protected]</a></span><span

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Targets

- Target
  
  4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41.exe
- Size
  
  149KB
- MD5
  
  7328af3a365df9561a55e86421fb81c0
- SHA1
  
  6cfb5b4a68100678d95270e3d188572a30abd568
- SHA256
  
  4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41
- SHA512
  
  d36bc6ff51047aecacbafd92af6581e766d9b38720c5d9443f96a58e213c33a50291d578b18dc77f9b6977eaae712764aa0b49da82c0a9e3fb264e93b0033369
- SSDEEP
  
  3072:kudyVkuftDR6PhpKHxf09vLOn8LlB9MJ:kyVzpKHxfkv1l
Score

10^/10

ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (5324) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Renames multiple (570) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2