Overview

overview

10

Static

static

3

f9b0a14a20...16.exe

windows7-x64

10

f9b0a14a20...16.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416
  • Size 352KB
  • Sample240530-lyf9aaef24
  • SHA256 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\wKTiyscK2.README.txt

Ransom Note
  • To recover your encrypted data, you must purchase a decryptor from us. We accept XMR (Monero) or BTC (Bitcoins) cryptocurrencies. XMR payment must be sent to: 8AP3aG4nxR3gka11FEDnJGftEyJkQLTVEQjPgrzkh2JU9u6KZYtLdn9eQynn1ogJgUhPBHVp6UoWANgETHK9wHUtQHLcSAa BTC payment must be sent to: 14hsKjR7L2KNmPpzeoXtNB8C2AuBL5Ch88 If you pay within 3 hours, then you only have to pay either 5 XMR or 0.1 BTC. If you pay within 6 hours, then you only have to pay either 15 XMR or 0.3 BTC. If you pay within 12 hours, then you only have to pay either 45 XMR or 0.9 BTC. If you pay within 24 hours, then you only have to pay either 135 XMR or 2.7 BTC. If you pay within 48 hours, then you must pay either 405 XMR or 8.1 BTC. If you pay within 96 hours, then you must pay either 1215 XMR or 24.3 BTC. After 96 hours you cannot recover your data. If you cooperate with us, then you will recover your data. If you delete or alter your files, or if you attempt to recover the data yourself, then your data will be lost forever. The decryptor won't work if you modify anything. To receive the decryptor to recover your data, carefully follow these instructions: 1. Send XMR to 8AP3aG4nxR3gka11FEDnJGftEyJkQLTVEQjPgrzkh2JU9u6KZYtLdn9eQynn1ogJgUhPBHVp6UoWANgETHK9wHUtQHLcSAa 2. Pay in full. Any lesser amount will be ignored. Copy and paste the XMR address. Do not type it by hand. 3. Email us at [email protected] 4. Include the TXID and TXKEY of your payment at the beginning of your email. So we know it is from you. Emails without this info will be ignored. 5. Plain text only. Any attachments, links, javascript, or other fingerprinting will be blocked and ignored, and we will not send the decryptor. 6. Please be patient. We check email often but not every second. Using your normal email will expedite your recovery. 7. If our email is broken, bounces back, or is compromised, then you may instead email us at: [email protected] 8. After 1 confirmation on the blockchain, of the correct amount according to the timetable, only then will we reply with the decryptor. 9. You may need to check your spam folder for our reply. The decryptor will include instructions how to fully recover your data. If you are too stupid to use XMR, then you may instead pay with Bitcoins. Bitcoins may be sent to: 14hsKjR7L2KNmPpzeoXtNB8C2AuBL5Ch88 Please include your BTC TxID in your email and a very brief explanation why you're stupid. If you are too stupid to understand that your data are gone forever, unless you pay, then not even a decryptor can help you. If you are smart enough to understand why you're racing and whom you're racing against, then tell us in your email. If correct, then we will fully refund your XMR or BTC when we send the decryptor. We don't think you're smart enough to understand why you're racing, but we hope to be surprised. WE WILL NOT REPLY UNTIL PAYMENT IS RECEIVED. WE WILL NOT SEND THE DECRYPTOR IF YOU ATTEMPT TO IDENTIFY US OR STOP US IN ANY WAY. IF YOU COMPLY AND PAY, YOUR DATA CAN BE RECOVERED IN LESS THAN A DAY. IF YOU HAVE BACKUPS AND ARE UNAFFECTED BY THIS RACE, THEN YOU ALREADY WON.
Wallets

  • 14hsKjR7L2KNmPpzeoXtNB8C2AuBL5Ch88

Targets

    • Target
      f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416
    • Size 352KB
    • SHA256 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    ransomwarespywarestealer

    • Renames multiple (348) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks