General

  • Target

    avatar-pc-BYE_BYE_Nard.vrca

  • Size

    27.5MB

  • Sample

    240505-ah52xsbd23

  • MD5

    fdadba4a3e9c52ca461c19fcab592d91

  • SHA1

    28176dbed29043ec5b5a53a0a6a93de0dd6ffdc6

  • SHA256

    7aee1fb68b3afa512c22fee8986a17a29e68168521d5c8fdb00c06a995153024

  • SHA512

    c95552fcc223e8e3dfdcf2829ebfe0a1707ecff3698a78db5d5c8774f08b300855114fece0e3b97eeb8d4f257a85a2c50e0f8ab67f5a6e06f9aba26450cd7b08

  • SSDEEP

    786432:NXRl4eDMyl/H62x+NHYU5v4t6aTczmuhx5mb3FejA:NXRlRnHR+N4USsfhxYFF

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

    • Target

      avatar-pc-BYE_BYE_Nard.vrca

    • Size

      27.5MB

    • MD5

      fdadba4a3e9c52ca461c19fcab592d91

    • SHA1

      28176dbed29043ec5b5a53a0a6a93de0dd6ffdc6

    • SHA256

      7aee1fb68b3afa512c22fee8986a17a29e68168521d5c8fdb00c06a995153024

    • SHA512

      c95552fcc223e8e3dfdcf2829ebfe0a1707ecff3698a78db5d5c8774f08b300855114fece0e3b97eeb8d4f257a85a2c50e0f8ab67f5a6e06f9aba26450cd7b08

    • SSDEEP

      786432:NXRl4eDMyl/H62x+NHYU5v4t6aTczmuhx5mb3FejA:NXRlRnHR+N4USsfhxYFF

MITRE ATT&CK Enterprise v15

Tasks