9d33bedd2e837e467b65eca3dfca05e1a4502dd2e032b6f2201a201e675a5eb4

General

Target

7824a49326b5244650a89e281c819177_JaffaCakes118
Size

108KB
Sample

240527-gszq8abc96
MD5

7824a49326b5244650a89e281c819177
SHA1

8d0a8babeb073954518157582ba484b4aeafde82
SHA256

9d33bedd2e837e467b65eca3dfca05e1a4502dd2e032b6f2201a201e675a5eb4
SHA512

58d58fc3373b965f7430d2b65c6b12716ca298aa3db56e3cf629afd18e6ae81ad3893722e1176ea6ea5b14a7788a20c644082fb49e1d994c63d029acc37483a2
SSDEEP

3072:WcOh/ij4dmVo+bZLDGBRSUZwjiaqE/uh0YOeAg:W1Kj4EVo+ZMSUZwjiaqE2CYDN

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\PLJQKRKMWEZJEHEVT.txt

Ransom Note

Not your language? Use the Google Translator: https://translate.google.com/ Attention! All your files are encrypted with AES 256 algorithm! Decoding is not possible without our decoder and universal key! In order to start the process of decoding the files, you need to contact us on the below contacts, with the subject: "I am willing to pay for the decode my files" , attaching an example of an encrypted file - Primary email: [email protected] - Secondary email: [email protected] - Bitmessage: BM-NBRCUPTenKgYbLVCAfeVUHVsHFK6Ue2F How To Use Bitmessage see https://www.youtube.com/watch?v=ndqIffqCMaM We encourage you to contact us for all three contacts! - Very important: We recommend to write email us with gmail address, otherwise your email may not reach us ,check the spam folder, probably our response email is in it! Do not try to decrypt files by third-party decipherers, otherwise you will spoil files ! You have 7 days to think about whether you your data or not, on the expiration of this period, without receiving an answer from you, we remove the universal key for your PC and you lose the ability to recover their files forever !!!

Emails

[email protected]

Targets

- Target
  
  7824a49326b5244650a89e281c819177_JaffaCakes118
- Size
  
  108KB
- MD5
  
  7824a49326b5244650a89e281c819177
- SHA1
  
  8d0a8babeb073954518157582ba484b4aeafde82
- SHA256
  
  9d33bedd2e837e467b65eca3dfca05e1a4502dd2e032b6f2201a201e675a5eb4
- SHA512
  
  58d58fc3373b965f7430d2b65c6b12716ca298aa3db56e3cf629afd18e6ae81ad3893722e1176ea6ea5b14a7788a20c644082fb49e1d994c63d029acc37483a2
- SSDEEP
  
  3072:WcOh/ij4dmVo+bZLDGBRSUZwjiaqE/uh0YOeAg:W1Kj4EVo+ZMSUZwjiaqE2CYDN
Score

10^/10

persistence ransomware spyware stealer upx
- Renames multiple (465) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2