6f90dd4223c979615f55b7a6a6c88370052b96cc4309cde2048a00d8fab60b17

General

Target
VirusShare_495156ba604fe45c08317b6a021ac519
Size 368KB
Sample240610-ngaraagg7y
SHA256 6f90dd4223c979615f55b7a6a6c88370052b96cc4309cde2048a00d8fab60b17
MD5 495156ba604fe45c08317b6a021ac519
SHA1 7220daf581a1a054020a2f30313b4b2cee7916f2
SHA512 80f33d16ed8dbf9036e466264019ef538d296c39a697b545707697e978df6454967a82bcb8115e13b125eac42af8975740ecb72546784d680ed834865f73fd4b
SSDEEP 6144:2BVsLLdsgLTCEUyQETKuSkPZ5PMVhewjAn6EYIW2gBsKTp0aLXWoRRBJY9HJJRws:hV3hLQET9P5UP06E+HsKl0aLNbs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\+-xxx-HELP-xxx-+csbmt-+.txt

Ransom Note

---------------------------------------------------- NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://9hrds.wolfcrap.at/B499ADB66C61557C http://6g4ds.froekuge.com/B499ADB66C61557C http://vewrb.italisumo.at/B499ADB66C61557C If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/B499ADB66C61557C *** Follow instructions on your screen !!! *** *** *** *** *** *** *** IMPORTANT INFORMATION *** *** *** *** *** *** Your personal homepages http://9hrds.wolfcrap.at/B499ADB66C61557C http://6g4ds.froekuge.com/B499ADB66C61557C http://vewrb.italisumo.at/B499ADB66C61557C Your personal homepage Tor-Browser k7tlx3ghr3m4n2tu.onion/B499ADB66C61557C Your personal ID B499ADB66C61557C

URLs

http://9hrds.wolfcrap.at/B499ADB66C61557C
http://6g4ds.froekuge.com/B499ADB66C61557C
http://vewrb.italisumo.at/B499ADB66C61557C
http://k7tlx3ghr3m4n2tu.onion/B499ADB66C61557C

Extracted

Path

C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+qhule-+.txt

Ransom Note

---------------------------------------------------- NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://9hrds.wolfcrap.at/3341D01EAC4D3430 http://6g4ds.froekuge.com/3341D01EAC4D3430 http://vewrb.italisumo.at/3341D01EAC4D3430 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/3341D01EAC4D3430 *** Follow instructions on your screen !!! *** *** *** *** *** *** *** IMPORTANT INFORMATION *** *** *** *** *** *** Your personal homepages http://9hrds.wolfcrap.at/3341D01EAC4D3430 http://6g4ds.froekuge.com/3341D01EAC4D3430 http://vewrb.italisumo.at/3341D01EAC4D3430 Your personal homepage Tor-Browser k7tlx3ghr3m4n2tu.onion/3341D01EAC4D3430 Your personal ID 3341D01EAC4D3430

URLs

http://9hrds.wolfcrap.at/3341D01EAC4D3430
http://6g4ds.froekuge.com/3341D01EAC4D3430
http://vewrb.italisumo.at/3341D01EAC4D3430
http://k7tlx3ghr3m4n2tu.onion/3341D01EAC4D3430

Targets

- Target
  VirusShare_495156ba604fe45c08317b6a021ac519
- Size 368KB
- SHA256 6f90dd4223c979615f55b7a6a6c88370052b96cc4309cde2048a00d8fab60b17
- MD5 495156ba604fe45c08317b6a021ac519
- SHA1 7220daf581a1a054020a2f30313b4b2cee7916f2
- SHA512 80f33d16ed8dbf9036e466264019ef538d296c39a697b545707697e978df6454967a82bcb8115e13b125eac42af8975740ecb72546784d680ed834865f73fd4b
- SSDEEP 6144:2BVsLLdsgLTCEUyQETKuSkPZ5PMVhewjAn6EYIW2gBsKTp0aLXWoRRBJY9HJJRws:hV3hLQET9P5UP06E+HsKl0aLNbs
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2