General
- Target cd4b4566460611a2dfa75f755270d5b2f56edff3d50a9ef6be8b3c92728c46a3
- Size 2.2MB
- Sample240101-pn7j9saghk
- SHA256 cd4b4566460611a2dfa75f755270d5b2f56edff3d50a9ef6be8b3c92728c46a3
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\HOW TO RESTORE YOUR FILES.TXT
Ransom Note
- Hello! All your files are encrypted, write to me if you want to return your files - I can do it very quickly! Contact me by email: [email protected] or [email protected] The subject line must contain an encryption extension or the name of your company! Do not rename encrypted files, you may lose them forever. You may be a victim of fraud. Free decryption as a guarantee. Send us up to 3 files for free decryption. The total file size should be no more than 1 MB! (not in the archive), and the files should not contain valuable information. (databases, backups, large Excel spreadsheets, etc.) !!! Do not turn off or restart the NAS equipment. This will lead to data loss !!! To contact us, we recommend that you create an email address at protonmail.com or tutanota.com Because gmail and other public email programs can block our messages!
Targets
-
- Target cd4b4566460611a2dfa75f755270d5b2f56edff3d50a9ef6be8b3c92728c46a3
- Size 2.2MB
- SHA256 cd4b4566460611a2dfa75f755270d5b2f56edff3d50a9ef6be8b3c92728c46a3
Score10/10-
Detecting the common Go functions and variables names used by Snatch ransomware
-
Snatch Ransomware
Ransomware family generally distributed through RDP bruteforce attacks.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (3317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 3.9MB
- SHA256 61033f4e5908e6f85058725d233205c4424814fb12154599cb6927b1968f3c78
Score3/10