General
- Target 240118-29gxysfhd8
- Size 147KB
- Sample240304-fmrb8aae2y
- SHA256 2a9e966a71b0eee58ea91f81e2ace3484bc6c23e9d55cd1a6280a8992fdca07a
Score
10/10
Malware Config
Extracted
Path
-
C:\RlfdcQhp8.README.txt
Ransom Note
- Ransomware (dyamond) All of your files have been encrypted and stolen by us. We have utilized advanced AES and ECC algorithms to accomplish this. Without our decryption service, it is impossible for anyone to recover your files. To initiate the recovery process, you will need to follow these steps. We want to clarify that we are not driven by any political motives and our sole intention is to obtain monetary compensation. If you choose to pay, we will provide you with the necessary decryption software and ensure the destruction of the stolen data. Your Personal ID : 5B74E5A5CA3D89EAC7A09EFA8CF96276 To guarantee our commitment, you are required to send us an unimportant file that is less than 1 MG in size. We will decrypt this file as proof of our capabilities. If we fail to deliver the decryption software or delete the stolen data, we understand that no one will pay us in the future, and we are committed to upholding our promise. To contact us, please use the following email address: [email protected] In the event that you do not receive a response within 24 hours, please contact us through this alternative email: [email protected] Remember to include your personal ID in the subject of the email. We would like to issue a few warnings: 1. Avoid engaging with recovery companies, as they are merely intermediaries seeking to profit from your situation and deceive you. They often negotiate with us secretly, purchase decryption software, and sell it to you at exorbitant prices, or they may even scam you outright. 2. It is crucial not to delay for an extended period. The sooner you make the payment, the lower the price will be. 3. Do not delete or modify any encrypted files, as doing so will complicate the decryption process.
Extracted
Path
-
C:\RlfdcQhp8.README.txt
Ransom Note
- Ransomware (dyamond) All of your files have been encrypted and stolen by us. We have utilized advanced AES and ECC algorithms to accomplish this. Without our decryption service, it is impossible for anyone to recover your files. To initiate the recovery process, you will need to follow these steps. We want to clarify that we are not driven by any political motives and our sole intention is to obtain monetary compensation. If you choose to pay, we will provide you with the necessary decryption software and ensure the destruction of the stolen data. Your Personal ID : 5B74E5A5CA3D89EAE24279DFE415E736 To guarantee our commitment, you are required to send us an unimportant file that is less than 1 MG in size. We will decrypt this file as proof of our capabilities. If we fail to deliver the decryption software or delete the stolen data, we understand that no one will pay us in the future, and we are committed to upholding our promise. To contact us, please use the following email address: [email protected] In the event that you do not receive a response within 24 hours, please contact us through this alternative email: [email protected] Remember to include your personal ID in the subject of the email. We would like to issue a few warnings: 1. Avoid engaging with recovery companies, as they are merely intermediaries seeking to profit from your situation and deceive you. They often negotiate with us secretly, purchase decryption software, and sell it to you at exorbitant prices, or they may even scam you outright. 2. It is crucial not to delay for an extended period. The sooner you make the payment, the lower the price will be. 3. Do not delete or modify any encrypted files, as doing so will complicate the decryption process.
Targets
-
- Target 240118-29gxysfhd8
- Size 147KB
- SHA256 2a9e966a71b0eee58ea91f81e2ace3484bc6c23e9d55cd1a6280a8992fdca07a
Score10/10Renames multiple (306) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)