dearcry

Resubmissions

28-02-2024 18:31

240228-w6jpgsah67 10

28-02-2024 18:30

11-01-2024 08:38

11-01-2024 08:35

26-07-2021 12:39

Sharing

Copy URL

Twitter E-mail

General

Target

10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da.sample
Size

1.3MB
Sample

240228-w6jpgsah67
MD5

9f05994819a3d8c1a3769352c7c39d1d
SHA1

eb2457196e04dfdd54f70bd32ed02ae854d45bc0
SHA256

10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da
SHA512

32cac848f47a0096773435c6365fcbd6bdb02115aae2677aec5a86031b6def938033210fdcf0e12f735aa5ceb8cd4be5f7edb5cdc437bbca61f0d79196ec9be8
SSDEEP

24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkzVZgMCST:L7XP7P9o5QzUtl1fpxkzVZgMCA

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\DesktopSharingHub\readme.txt

Family

dearcry

Ransom Note

Your file has been encrypted! If you want to decrypt, please contact us. konedieyp@airmail.cc or uenwonken@memail.com And please send me the following hash! 2133c369fb115ea61eebd7b62768decf

Emails

konedieyp@airmail.cc

uenwonken@memail.com

Targets

- Target
  
  10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da.sample
- Size
  
  1.3MB
- MD5
  
  9f05994819a3d8c1a3769352c7c39d1d
- SHA1
  
  eb2457196e04dfdd54f70bd32ed02ae854d45bc0
- SHA256
  
  10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da
- SHA512
  
  32cac848f47a0096773435c6365fcbd6bdb02115aae2677aec5a86031b6def938033210fdcf0e12f735aa5ceb8cd4be5f7edb5cdc437bbca61f0d79196ec9be8
- SSDEEP
  
  24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkzVZgMCST:L7XP7P9o5QzUtl1fpxkzVZgMCA
Score

10^/10

dearcry ransomware spyware stealer
- DearCry
  DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.
  ransomware dearcry
- Renames multiple (3368) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1