Overview

overview

10

Static

static

10

ransom.exe

windows7-x64

1

ransom.exe

windows10-2004-x64

10

Resubmissions

27/02/2024, 16:15

240227-tqdr7adf4810

27/02/2024, 16:15

240227-tqbyladf47

01/12/2023, 17:45

231201-wb5ngaed2x9

Sharing

Copy URL Twitter E-mail

General

  • Target
    ransom.exe
  • Size 2.6MB
  • Sample240227-tqdr7adf48
  • SHA256 d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
kuiperevasionransomware

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\README_TO_DECRYPT.txt

Ransom Note
  • Your network has been compromised! All your important data has been encrypted! There is only one way to get your data back to normal: 1. Contact us as soon as possible to avoid damages and losses from your business. 2. Send to us any encrypted file of your choice and your personal key. 3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files. 4. Pay the amount required in order to restore your network back to normal. 5. We will then send you our software to decrypt and will guide you through the whole restoration of your network. We prefer Monero (XMR) - FIXED PRICE We accept Bitcoin (BTC) - 20% extra of total payment! ============================================================================================================================ WARNING! Do not rename encrypted data. Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover. ============================================================================================================================ Contact information: In order to contact us, download with the following software: https://qtox.github.io or https://tox.chat/download.html Then just add us in TOX: D27A7B3711CD1442A8FAC19BB5780FF291101F6286A62AD21E5F7F08BD5F5F1B9803AAC6ECF9 OR Through email: [email protected] ============================================================================================================================ Your personal id: 5253413d39363033333039633033636664663735626438343064343436363833383533313a313531313a66616c7365
URLs

  • https://qtox.github.io

  • https://tox.chat/download.html

Targets

    • Target
      ransom.exe
    • Size 2.6MB
    • SHA256 d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    evasionransomware

    • Clears Windows event logs

      evasionransomware

    • Renames multiple (2364) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks