104b22a45e4166a5473c9db924394e1fe681ef374970ed112edd089c4c8b83f2

General

Target

104b22a45e4166a5473c9db924394e1fe681ef374970ed112edd089c4c8b83f2
Size

5.4MB
Sample

240425-xvscxsdg23
MD5

cfb2286b45544fdb23569f59c02e3d58
SHA1

82793d93d987abb357809f069420d17a25a59f26
SHA256

104b22a45e4166a5473c9db924394e1fe681ef374970ed112edd089c4c8b83f2
SHA512

f72316b083f92763fc58e7826f63072141b845c7319e85ce256ba21297fc035925e95d16193a44d2188912892b1b08828a97a896181566a61d5e472543560d7a
SSDEEP

49152:jM4us5cOkWus2MYrRgGxznum8Uf3lDiFXnKZ5ERDLKJ5YVpWKUYg/4+6Wfctm1AE:haOvZ4rm1UdLEUqB+

Score

10^/10

ransomware

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\How_To_Restore_Your_Files.txt

Ransom Note

>> What happens? Your data is stolen and encrypted.If you don't pay the ransom, the data will be published on our blog(http://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion). Keep in mind that once your data appears on our blog, it could be bought by your competitors at any second, so don't hesitate for a long time. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/).[If you don't know that, Google search!] 2. Open http://vogjzince7niuj34d7wckrqbfgf7klcokzgt7b2hw42bzwwzzvdvdsqd.onion/6ef9cc13508ab2863bf708dd841e549afa2cb5a44bffe987b8580c7006b37b9aa7b416e9d6d23d4893c74b167e395a41/ >>> Warning! Recovery recommendations. Do not MODIFY or REPAIR your files, Or they will be lost forever. Do not hire a recovery company.Can't solve anything without us,They always think they're expert negotiators, but the truth is they don't care about you and business Do not report to the Police, FBI,They don't care about your business and it's going to get worse.(You could be hit with a hefty fine.)

URLs

http://vogjzince7niuj34d7wckrqbfgf7klcokzgt7b2hw42bzwwzzvdvdsqd.onion/6ef9cc13508ab2863bf708dd841e549afa2cb5a44bffe987b8580c7006b37b9aa7b416e9d6d23d4893c74b167e395a41/

Targets

- Target
  
  104b22a45e4166a5473c9db924394e1fe681ef374970ed112edd089c4c8b83f2
- Size
  
  5.4MB
- MD5
  
  cfb2286b45544fdb23569f59c02e3d58
- SHA1
  
  82793d93d987abb357809f069420d17a25a59f26
- SHA256
  
  104b22a45e4166a5473c9db924394e1fe681ef374970ed112edd089c4c8b83f2
- SHA512
  
  f72316b083f92763fc58e7826f63072141b845c7319e85ce256ba21297fc035925e95d16193a44d2188912892b1b08828a97a896181566a61d5e472543560d7a
- SSDEEP
  
  49152:jM4us5cOkWus2MYrRgGxznum8Uf3lDiFXnKZ5ERDLKJ5YVpWKUYg/4+6Wfctm1AE:haOvZ4rm1UdLEUqB+
Score

10^/10

ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (162) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
behavioral1