Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

VirusShare...de.exe

windows7-x64

10

VirusShare...de.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VirusShare_99e83f42796e5390063243810c0629de

  • Size

    184KB

  • Sample

    240610-nylvwahf6w

  • MD5

    99e83f42796e5390063243810c0629de

  • SHA1

    a97c9cdff2002fc328a933df1ae3bc67508814ee

  • SHA256

    722d3afa33d79b277e4198517084248b25db8dc90207b5ee4fff76dfa2b19fb5

  • SHA512

    ecc5e1e8fe8b36dbf2326e182772ca852e155f8deb5562e3ff707538c5b24961c16a44b26737efbd09cc6d38683cf51c1a363e2668c27f7453ffea21eb0a7a2c

  • SSDEEP

    3072:jFIkQ7yjaILMvzovwBB82T/NyG86ry6BSTqQ+hvVdhCL9juDEDsj/RR:pjLMswHHQG86ry6BSGLVAjuv

Score
10/10
defense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\+REcovER+xfkps+.txt

Ransom Note
*06)5)*>?4(?$>2''-=1%(><0$6=:.# *06)5)*>?4(?$>2''-=1%(><0$6=:.# *06)5)*>?4(?$>2''-=1%(><0$6=:.# *06)5)*>?4(?$>2''-=1%(><0$6=:.# NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://i5ndw.titlecorta.at/6A4CE9A63B39ECC8 http://d34fa.lasmeio.com/6A4CE9A63B39ECC8 http://2gdb4.leoraorage.at/6A4CE9A63B39ECC8 *06)5)*>?4(?$>2''-=1%(><0$6=:.# *06)5)*>?4(?$>2''-=1%(><0$6=:.# *06)5)*>?4(?$>2''-=1%(><0$6=:.#r If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/6A4CE9A63B39ECC8 *** *** *** *** *** *** *** IMPORTANT INFORMATION *** *** *** *** *** *** Your personal homepages http://i5ndw.titlecorta.at/6A4CE9A63B39ECC8 http://d34fa.lasmeio.com/6A4CE9A63B39ECC8 http://2gdb4.leoraorage.at/6A4CE9A63B39ECC8 Your personal homepage Tor-Browser k7tlx3ghr3m4n2tu.onion/6A4CE9A63B39ECC8 Your personal ID 6A4CE9A63B39ECC8 *06)5)*>?4(?$>2''-=1%(><0$6=:.# *06)5)*>?4(?$>2''-=1%(><0$6=:.# *06)5)*>?4(?$>2''-=1%(><0$6=:.#
URLs

http://i5ndw.titlecorta.at/6A4CE9A63B39ECC8

http://d34fa.lasmeio.com/6A4CE9A63B39ECC8

http://2gdb4.leoraorage.at/6A4CE9A63B39ECC8

http://k7tlx3ghr3m4n2tu.onion/6A4CE9A63B39ECC8

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\+REcovER+xfkps+.html

Ransom Note
<html><style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style='background:#33CCFF;'> <center><div style='text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;'> <b><font class='ttl'><center><b>NOT YOUR LANGUAGE? USE <a href=https://translate.google.com target='_blank'>Google Translate</a></b></center> What happened to your files?</b></font><br> <font style='font-size:13px;'>All of your files were pr<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->o<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->t<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->e<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ct<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->e<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->d <!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->by a s<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->t<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->vr<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ong encr<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->yption with R<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->S<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->A<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->-4<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->0<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->9<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->6 <br> More information about the encryption RSA-4<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->0<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->9<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->6 c<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->a<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->n b<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->e <!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->f<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->o<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->u<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->n<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->d <a href= http://en.wikipedia.org/wiki/RSA_(cryptosystem) target='_blank'> https://en.wikipedia.org/wiki/RSA_(cryptosystem) </a><br></font> <br><b><font class='ttl'>What does this mean?</b></font><br><font style='font-size:13px;'>This means that the structure and data within yourfiles have been irrevocably changed, you will not be able work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them <br><br><b><font class='ttl'> How did this happen? </b></font> <br> <font style='font-size:13px;'> Espe<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->cially for you, on our SE<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->RVE<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->R was gener<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ated the se<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->cret key<br>All your files were encrypted with the public key,which has been transferred to your com<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->puter via the Int<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ernet. <br>Decrypting of YO<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->UR FI<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->LES isonly poss<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ible with the help of the pr<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ivate key and decrypt pro<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->gram which is on our Secret Server!!!</font><br><br><b><font class='ttl'>What do I do?</b></font> <br><font style='font-size:13px;'>Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed <br> If you really need your data, then we suggest you do not wastevaluable time searching for other solutions becausen they do not exist.</font><br><br> <div class='tb' style='color:#880000; font-size:13px; border-width:3px;'>For more specific instructions, please visit your pers<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->onal home page, there are a few different addresses point<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ing to your page be<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->low<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->:<b><hr> 1 - <a href=http://i5ndw.titlecorta.at/6A4CE9A63B39ECC8 target="_blank">http://i5ndw.titlecorta.at/6A4CE9A63B39ECC8</a> <br> 2 - <a href=http://d34fa.lasmeio.com/6A4CE9A63B39ECC8 target="_blank">http://d34fa.lasmeio.com/6A4CE9A63B39ECC8</a> <br> 3 - <a href=http://2gdb4.leoraorage.at/6A4CE9A63B39ECC8 target="_blank">http://2gdb4.leoraorage.at/6A4CE9A63B39ECC8</a> <br> </div><br><div class='tb' style='font-size:13px; border-color:#880000;'><b>If for some reasons the addresses are not available, follow these steps:</b> <hr> 1 - Download and install tor-browser: <a href=http://www.torproject.org/projects/torbrowser.html.en target='_blank'>http://www.torproject.org/projects/torbrowser.html.en</a><br> 2 - After a successful installation, run the browser and wait for initialization.<br> 3 - Typ<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->e in the tor-<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->browser address b<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ar<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->: <font style='font-weight:bold; color:#009977;'>k7tlx3ghr3m4n2tu.onion/6A4CE9A63B39ECC8 </font> <br> 4 - F<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ollow the in<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->structions on the site.</div><br><br><b>!!! IMPOR<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->TANT INFOR<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->MATION:</b><br> <div class='tb' style='width:790px;'> Yo<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ur Per<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->sonal PAG<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ES<b><!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->: <br> <a href=http://i5ndw.titlecorta.at/6A4CE9A63B39ECC8 target='_blank'> http://i5ndw.titlecorta.at/6A4CE9A63B39ECC8</a> <br><a href=http://d34fa.lasmeio.com/6A4CE9A63B39ECC8 target='_blank> http://d34fa.lasmeio.com/6A4CE9A63B39ECC8</a></a> <br> <a href=http://2gdb4.leoraorage.at/6A4CE9A63B39ECC8 target='_blank'> http://2gdb4.leoraorage.at/6A4CE9A63B39ECC8</a> <br>Yo<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ur P<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ers<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->onal TO<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->R-Br<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ow<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ser page :<font style='font-weight:bold; color:#009977;'> k7tlx3ghr3m4n2tu.onion/6A4CE9A63B39ECC8 </font><br> Yo<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->ur pers<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->onal <!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->I<!---*06)5)*>?4(?$>2''-=1%(><0$6=:.#-->D (if you open the site directly) :<font style='font-weight:bold; color:#770000;'>6A4CE9A63B39ECC8</font><br> </div></div></center></body></html>
URLs

http://i5ndw.titlecorta.at/6A4CE9A63B39ECC8</a>

http://d34fa.lasmeio.com/6A4CE9A63B39ECC8</a></a>

http://2gdb4.leoraorage.at/6A4CE9A63B39ECC8</a>

http://k7tlx3ghr3m4n2tu.onion/6A4CE9A63B39ECC8

Extracted

Path

C:\Program Files\7-Zip\Lang\+REcovER+uhmfj+.txt

Ransom Note
(&29-% ?33=#60!2=;/#*."'<-!?%+ (&29-% ?33=#60!2=;/#*."'<-!?%+ (&29-% ?33=#60!2=;/#*."'<-!?%+ (&29-% ?33=#60!2=;/#*."'<-!?%+ NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://i5ndw.titlecorta.at/B5EC285F737BD644 http://d34fa.lasmeio.com/B5EC285F737BD644 http://2gdb4.leoraorage.at/B5EC285F737BD644 (&29-% ?33=#60!2=;/#*."'<-!?%+ (&29-% ?33=#60!2=;/#*."'<-!?%+ (&29-% ?33=#60!2=;/#*."'<-!?%+ r If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/B5EC285F737BD644 *** *** *** *** *** *** *** IMPORTANT INFORMATION *** *** *** *** *** *** Your personal homepages http://i5ndw.titlecorta.at/B5EC285F737BD644 http://d34fa.lasmeio.com/B5EC285F737BD644 http://2gdb4.leoraorage.at/B5EC285F737BD644 Your personal homepage Tor-Browser k7tlx3ghr3m4n2tu.onion/B5EC285F737BD644 Your personal ID B5EC285F737BD644 (&29-% ?33=#60!2=;/#*."'<-!?%+ (&29-% ?33=#60!2=;/#*."'<-!?%+ (&29-% ?33=#60!2=;/#*."'<-!?%+
URLs

http://i5ndw.titlecorta.at/B5EC285F737BD644

http://d34fa.lasmeio.com/B5EC285F737BD644

http://2gdb4.leoraorage.at/B5EC285F737BD644

http://k7tlx3ghr3m4n2tu.onion/B5EC285F737BD644

Extracted

Path

C:\Program Files\7-Zip\Lang\+REcovER+uhmfj+.html

Ransom Note
<html><style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style='background:#33CCFF;'> <center><div style='text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;'> <b><font class='ttl'><center><b>NOT YOUR LANGUAGE? USE <a href=https://translate.google.com target='_blank'>Google Translate</a></b></center> What happened to your files?</b></font><br> <font style='font-size:13px;'>All of your files were pr<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->o<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->t<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->e<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ct<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->e<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->d <!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->by a s<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->t<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->vr<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ong encr<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->yption with R<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->S<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->A<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->-4<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->0<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->9<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->6 <br> More information about the encryption RSA-4<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->0<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->9<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->6 c<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->a<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->n b<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->e <!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->f<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->o<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->u<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->n<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->d <a href= http://en.wikipedia.org/wiki/RSA_(cryptosystem) target='_blank'> https://en.wikipedia.org/wiki/RSA_(cryptosystem) </a><br></font> <br><b><font class='ttl'>What does this mean?</b></font><br><font style='font-size:13px;'>This means that the structure and data within yourfiles have been irrevocably changed, you will not be able work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them <br><br><b><font class='ttl'> How did this happen? </b></font> <br> <font style='font-size:13px;'> Espe<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->cially for you, on our SE<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->RVE<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->R was gener<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ated the se<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->cret key<br>All your files were encrypted with the public key,which has been transferred to your com<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->puter via the Int<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ernet. <br>Decrypting of YO<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->UR FI<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->LES isonly poss<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ible with the help of the pr<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ivate key and decrypt pro<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->gram which is on our Secret Server!!!</font><br><br><b><font class='ttl'>What do I do?</b></font> <br><font style='font-size:13px;'>Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed <br> If you really need your data, then we suggest you do not wastevaluable time searching for other solutions becausen they do not exist.</font><br><br> <div class='tb' style='color:#880000; font-size:13px; border-width:3px;'>For more specific instructions, please visit your pers<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->onal home page, there are a few different addresses point<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ing to your page be<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->low<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->:<b><hr> 1 - <a href=http://i5ndw.titlecorta.at/B5EC285F737BD644 target="_blank">http://i5ndw.titlecorta.at/B5EC285F737BD644</a> <br> 2 - <a href=http://d34fa.lasmeio.com/B5EC285F737BD644 target="_blank">http://d34fa.lasmeio.com/B5EC285F737BD644</a> <br> 3 - <a href=http://2gdb4.leoraorage.at/B5EC285F737BD644 target="_blank">http://2gdb4.leoraorage.at/B5EC285F737BD644</a> <br> </div><br><div class='tb' style='font-size:13px; border-color:#880000;'><b>If for some reasons the addresses are not available, follow these steps:</b> <hr> 1 - Download and install tor-browser: <a href=http://www.torproject.org/projects/torbrowser.html.en target='_blank'>http://www.torproject.org/projects/torbrowser.html.en</a><br> 2 - After a successful installation, run the browser and wait for initialization.<br> 3 - Typ<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->e in the tor-<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->browser address b<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ar<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->: <font style='font-weight:bold; color:#009977;'>k7tlx3ghr3m4n2tu.onion/B5EC285F737BD644 </font> <br> 4 - F<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ollow the in<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->structions on the site.</div><br><br><b>!!! IMPOR<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->TANT INFOR<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->MATION:</b><br> <div class='tb' style='width:790px;'> Yo<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ur Per<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->sonal PAG<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ES<b><!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->: <br> <a href=http://i5ndw.titlecorta.at/B5EC285F737BD644 target='_blank'> http://i5ndw.titlecorta.at/B5EC285F737BD644</a> <br><a href=http://d34fa.lasmeio.com/B5EC285F737BD644 target='_blank> http://d34fa.lasmeio.com/B5EC285F737BD644</a></a> <br> <a href=http://2gdb4.leoraorage.at/B5EC285F737BD644 target='_blank'> http://2gdb4.leoraorage.at/B5EC285F737BD644</a> <br>Yo<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ur P<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ers<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->onal TO<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->R-Br<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ow<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ser page :<font style='font-weight:bold; color:#009977;'> k7tlx3ghr3m4n2tu.onion/B5EC285F737BD644 </font><br> Yo<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->ur pers<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->onal <!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->I<!---(&29-% ?33=#60!2=;/#*."'<-!?%+ -->D (if you open the site directly) :<font style='font-weight:bold; color:#770000;'>B5EC285F737BD644</font><br> </div></div></center></body></html>
URLs

http://i5ndw.titlecorta.at/B5EC285F737BD644</a>

http://d34fa.lasmeio.com/B5EC285F737BD644</a></a>

http://2gdb4.leoraorage.at/B5EC285F737BD644</a>

http://k7tlx3ghr3m4n2tu.onion/B5EC285F737BD644

Targets

    • Target

      VirusShare_99e83f42796e5390063243810c0629de

    • Size

      184KB

    • MD5

      99e83f42796e5390063243810c0629de

    • SHA1

      a97c9cdff2002fc328a933df1ae3bc67508814ee

    • SHA256

      722d3afa33d79b277e4198517084248b25db8dc90207b5ee4fff76dfa2b19fb5

    • SHA512

      ecc5e1e8fe8b36dbf2326e182772ca852e155f8deb5562e3ff707538c5b24961c16a44b26737efbd09cc6d38683cf51c1a363e2668c27f7453ffea21eb0a7a2c

    • SSDEEP

      3072:jFIkQ7yjaILMvzovwBB82T/NyG86ry6BSTqQ+hvVdhCL9juDEDsj/RR:pjLMswHHQG86ry6BSGLVAjuv

    Score
    10/10
    defense_evasionexecutionimpactpersistenceransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks