d0f05cd6957e1e93d1ca4154762b4d4bcaeb16c0bf878b59a1500c4974ef4502

General

Target

d0f05cd6957e1e93d1ca4154762b4d4bcaeb16c0bf878b59a1500c4974ef4502
Size

1.5MB
Sample

240101-sfsmxsfea5
MD5

8b891d9985adf40603aafd8ed3406c60
SHA1

b280e8787cae4164f508c502f46eee2230204c1e
SHA256

d0f05cd6957e1e93d1ca4154762b4d4bcaeb16c0bf878b59a1500c4974ef4502
SHA512

3aa8dd45435f4d98f273c7ab1094f3e9e10c131716f59a2c9584383c94756d577424067b51e34dc1e6dc875dfc4f45d7b47f2b297e59d4bb0860f1018d33cb79
SSDEEP

24576:KctgHZ7Vq6FWfL7imwgiYhiAHuK/B0SdQZH4l9tfrxSfFldFu8hod/QodlyGG:Kct4pq6QffYKhiAHueGefrxS7FadRdd

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\instructions_read_me.txt

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 85f6d1b9-56ce-476f-aa84-a356da1f1b23 *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  d0f05cd6957e1e93d1ca4154762b4d4bcaeb16c0bf878b59a1500c4974ef4502
- Size
  
  1.5MB
- MD5
  
  8b891d9985adf40603aafd8ed3406c60
- SHA1
  
  b280e8787cae4164f508c502f46eee2230204c1e
- SHA256
  
  d0f05cd6957e1e93d1ca4154762b4d4bcaeb16c0bf878b59a1500c4974ef4502
- SHA512
  
  3aa8dd45435f4d98f273c7ab1094f3e9e10c131716f59a2c9584383c94756d577424067b51e34dc1e6dc875dfc4f45d7b47f2b297e59d4bb0860f1018d33cb79
- SSDEEP
  
  24576:KctgHZ7Vq6FWfL7imwgiYhiAHuK/B0SdQZH4l9tfrxSfFldFu8hod/QodlyGG:Kct4pq6QffYKhiAHueGefrxS7FadRdd
Score

10^/10

persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (4149) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Adds Run key to start application
  persistence
behavioral1 behavioral2