General
-
Target
cureit.exe
-
Size
294.1MB
-
Sample
240130-qlz8vagcc3
-
MD5
6f54e39afdbd115f01952b3eaccd2d79
-
SHA1
2f48c9ccb0b9489da158206e1a5bf450a1149cea
-
SHA256
81a096d9fac8b397176c475d4123e2824d09a1fd92287bd23796db7f6a4d7f27
-
SHA512
d868b8a7859b284297498432913f99a1f6b2af39797d21e8f29efbe669513d5575abfdcecf25d7a888d4c3c73b4843734e64ac9a32729375132a30233f490f98
-
SSDEEP
6291456:D9gTykZyrx6zSEYNXX1EEZ6pUU18+pVvJXbGth0cppIzLKRWRn/jP1kVM3HPQLHW:DpkZe6zSEYRX3UTITpp6d7Ca3Hy69
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>k6Nv5eg6ocDlvh7DoWqY0ekY/Ejp13pcFRYG1vFIQY9XzRDnIJpyoOLflDzIsg3QWNqJf6HKdP39BxmHIxwH05HaWRNT4YwMuqm5sBSRTfpNdkKfiU2kL7MDKDATcW9vfWk8TdBBSwmAwIKOUpUPdD79OxxLWFwMsUJyeOqh+PKKue7tQY9NR3zJdlqvPvJ1AysAxoBCj37UalK2Zv7JtFyzHgtW6cWdpTVji5CaCrhrtmeTZJbEW587HRPTsiXql6J/anZyiRfMxzPqoorMr5CGr2RmqaRSFgeVMZtm5uf5o7t98R0OOX0/bxN85Bhbye/10T742el5FjwRtr5OWg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>pBxUpfkkTK+ef9vmtxfbe8/hKBS+nOxjYjNMO/QCg+oJWOTF+HI3adPMvp/6U1y2l6ivQgtMqbdYgMTBGWoGI2pA+9hrQMM+q7Acv5dBtUIFAUXbmAjLgvRC4QeJ4Se4OX3Mf/L6NX3zZmuiTjoJIwd48gKJnAOR3W8S8UTPR999643ufuCqULWWFoz9NfTQWc3M8uDUK7Sc+l6gT4qXirawL5tz/juF5cinwBl4PcLHGsK8ljFBSC7oLBIKtFfvMj1gGhku4Bo5EVP45VHxW3cepk3GhUo5Fn7B5B386Hw5TPePTEluNV+FuPTdi+4oYUDiS/bcnLGziwaT+LAClw==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>ThjfB+wloJEHYm2txv1y0P5ooBb/NzvS/veT5Kc/HPNFBkit0lpg+zz9Jfi8IaHAhfqN4q2eNE5TrAFOs1KPr2yzhImdM3YZLorMULlBSHX/ar4AV+CXWag4K84yEELjza2Ox5fbmLV1LaSvpuk9ZmKKsiHsyuYA/N7SQ1xKTynjPMBG4SNX5X67zsmhbOrYWuwjTQL/XQS9lnyeue6Sq/AMbsowLWB3v9Z8LlN+4q2QEQlUBaX7fmNBEW2X4P56RLP+K+JYLlvVtajHbZz7+GwdnDN/9p2AWdDVov3rWt/VAEV/moFpfL2cyrNbKF8++hA2w6j0uBLP9U44nfINCw==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Targets
-
-
Target
cureit.exe
-
Size
294.1MB
-
MD5
6f54e39afdbd115f01952b3eaccd2d79
-
SHA1
2f48c9ccb0b9489da158206e1a5bf450a1149cea
-
SHA256
81a096d9fac8b397176c475d4123e2824d09a1fd92287bd23796db7f6a4d7f27
-
SHA512
d868b8a7859b284297498432913f99a1f6b2af39797d21e8f29efbe669513d5575abfdcecf25d7a888d4c3c73b4843734e64ac9a32729375132a30233f490f98
-
SSDEEP
6291456:D9gTykZyrx6zSEYNXX1EEZ6pUU18+pVvJXbGth0cppIzLKRWRn/jP1kVM3HPQLHW:DpkZe6zSEYRX3UTITpp6d7Ca3Hy69
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Sets service image path in registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks for any installed AV software in registry
-
Drops Chrome extension
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-