General
-
Target
e9ff14a975f084f01373d468c0b91a16.bin
-
Size
666KB
-
Sample
240426-cdqgsahb77
-
MD5
28f120186feeed04d7841a1875e582c9
-
SHA1
c8ba2f382f50ea9641117d300d6049934a1dcdce
-
SHA256
886d02cd740150c46138f23e0f30cb9a55b6b06d10c14e26742358bdeb8bf285
-
SHA512
17d814dd2f1dd9b4063b7ad6760d895a6cc3850a6dcd7d2b8c0e9201a3a477a91247c5f1eca54700bee26846f484fcedaa373e34663cb1757ecdf6f602548adf
-
SSDEEP
12288:cYshHOgxywb1/Zaj0zlmVrZzg54SVrZD9POkCZ0MJqAEXKTLvpe+9MoQT730CDZI:cYQOEdZU0wv0JjPCQbXKA5v30vdJ
Malware Config
Extracted
djvu
http://cajgtus.com/test2/get.php
-
extension
.bgzq
-
offline_id
Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1
-
payload_url
http://sdfjhuz.com/dl/build2.exe
http://cajgtus.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0864PsawqS
Targets
-
-
Target
f6a6765642f0f8c4b81f45d4e1a9f65505432bbf4c249fa3c96b82d9c712effe.exe
-
Size
763KB
-
MD5
e9ff14a975f084f01373d468c0b91a16
-
SHA1
302d4b9f88ae7b085b56661774d6805156039924
-
SHA256
f6a6765642f0f8c4b81f45d4e1a9f65505432bbf4c249fa3c96b82d9c712effe
-
SHA512
4c7965f1f1a123b57ab9ca49cd4b3db35c9d98086eec4cdd297b9b706d68dac25183d052934f564f935459c49471c953453202a99b8f0d62e03b0626d8c41ce0
-
SSDEEP
12288:M2dc5bz6tqdDlvGkNwikL95whi6SY7Mf6cMFqNjOjNiaUORnV77J1BDg:uWqdBpNwJLsi6v7iMpxDV77J3s
Score10/10-
Detected Djvu ransomware
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Modifies file permissions
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-