General
-
Target
1.bin
-
Size
447KB
-
Sample
240611-lwmnaaseqh
-
MD5
9823800f063a1d4ee7a749961db7540f
-
SHA1
9d2917a668b30ba9f6b3e7a3316553791eb1c052
-
SHA256
a9524de985a3ecc43e11dd7c051a4bbfe08c3d71cde98ea9bb6ea7f32c0cb174
-
SHA512
c48624e32dba7f08ce0ca8267e541b123c6a9bf848b81d9e62f7fc4bec9b8ed801a6204ffaece4decf0d31bf2595867ff6f8c0b176e366848b61145cc585e41e
-
SSDEEP
12288:Yn+KS3UINuBGCz0SxWUNmH2o8PXwU9Eq7zKloxTwRtjauqCXy3X:Y+FUKWAHNqXwUlzD9w7PqCin
Score
10/10
Malware Config
Extracted
Path
C:\Users\DECRYPT-FILES.html
Ransom Note
<html>
<head>
<script>
function CopyToClipboard(containerid) {
if (document.selection) {
var range = document.body.createTextRange();
range.moveToElementText(document.getElementById(containerid));
range.select().createTextRange();
document.execCommand("copy");
} else if (window.getSelection) {
var range = document.createRange();
range.selectNode(document.getElementById(containerid));
window.getSelection().addRange(range);
document.execCommand("copy");
alert("Base64 copied into the clipboard!")
}
}
</script>
<style>
html{ margin:0; padding:0; width:100%; height:100%; }
body { background: #000080; color: #ececec; font-family: Consolas };
.tooltip {
position: relative;
display: inline-block;
border-bottom: 1px dotted black;
}
.tooltip .tooltiptext {
visibility: hidden;
width: 120px;
background-color: #555;
color: #fff;
text-align: center;
border-radius: 6px;
padding: 5px 0;
position: absolute;
z-index: 1;
bottom: 125%;
left: 50%;
margin-left: -60px;
opacity: 0;
transition: opacity 0.3s;
}
.tooltip .tooltiptext::after {
content: "";
position: absolute;
top: 100%;
left: 50%;
margin-left: -5px;
border-width: 5px;
border-style: solid;
border-color: #555 transparent transparent transparent;
}
.tooltip:hover .tooltiptext {
visibility: visible;
opacity: 1;
}
p#base64{
-ms-word-break: break-all;
word-break: break-all;
-webkit-hyphens: auto;
-moz-hyphens: auto;
-ms-hyphens: auto;
hyphens: auto;
}
p#base64:hover{
cursor: hand;
}
</style>
</head>
<body>
<table style="position: absolute;" width="100%">
<tr>
<td style="width: 25%;">
<span class="left" style="font-size: 14px; font-weight: bold">CODE:
<br>------
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
</span>
</td>
<td style="width: 50%;">
<div style="text-align: center; font-size: 20px;">
<p><s>0010 SYSTEM FAILURE 0010</s></p>
<p>*********************************************************************************************************************</p>
<p>Attention! Your documents, photos, databases, and other important files have been encrypted!</p>
<p>*********************************************************************************************************************</p>
<br>
</div>
<div style="text-align: center; font-size: 18px;">
<p>The only way to decrypt your files, is to buy the private key from us.</p>
<p>You can decrypt one of your files for free, as a proof that we have the method to decrypt the rest of your data.</p>
<p>In order to receive the private key contact us via email: <br> <b>[email protected]</b> </p>
<p>Remember to hurry up, as your email address may not be avaliable for very long.<br>Buying the key immediatly will guarantee that 100% of your files will be restored.</p>
<p>Below you will see a big base64 blob, you will need to email us and copy this blob to us.<br>you can click on it, and it will be copied into the clipboard.</p>
<p>If you have troubles copying it, just send us the file you are currently reading, as an attachment.</p>
<br>
<p>Base64: </p>
</div><div style="text-align: center; font-size: 12px;"><p id="base64" onclick="return CopyToClipboard('base64')" class="tooltip">dGBx8hIN6ElA+Sk6xI96lWW453dgDvM5cIto2U79e/bOqEwP5l8k7+ItSFoyPZWeKQ+1/P7XK/hOj91UebA9coXPKgRHNDP31VccGurCKes7NvYrrG02fnnVFzsG/PZ2CbpXndGYNlhbD0Bx+XQ980ZJVyHViR+QfnNUmYpYe6Ck9Rynaa/Dqd1c7eLj+2qMBjtLH1Kt1fX/5HzvffV2KrSw5usKjXhzg/7U7bBWfFa5YdnR0LuDxhARzPp1roURJlk8iMNmfw6/wH2HmAtyl5dHaHSdrMpakFyQMU6jvPuZTWMbnKuaU1KwZT/j/MjIF1ju21ORt2ld2UyOWWOdhEUoRRlYFgWfEXgXe4uCgE8p2jvN/JfSX88YMR33JeeMQiaKyPtjTOyyE7PjOCHJ7tJ7bg7GvAg/EtPgRTQ4j4T5oktNB6IELCgx74/sVAOPtZk4MbZ9JBtEwxsthuTWhFikwSGAkmQEXaNLhu4Xa5cRz4ewbHETh/g9slTeAoD4wb3LHlQqaXKSQd7nDjI1LY899LHrtxIEDJKiR1bY67ipy33lbgkgJx6UE7thbBhDvSaC4gpXIKdvl65Tt/T7ZiSpjZ3Rza3oDBFDpk22NuSzRPZQMdZk2lQWYutjqe+8TbNt54le92Pt1LTO4xLf0zCONAnUHhYmsViXrox2ukXQ/BaNB9gaD2nioo6tO8uA5cipsqNMkh813a55sbmelPIpZYBmbLusPHi7HfEzi/bVQb7XW5HvARisvBqDHQrVLnpA9z/7VV/EEHlNW9bR9hobjzlIY5N7N1KiT+xpSoKmx2158O8um/N4leC6d1libT6OaYSDE7I3JWoYyuC/kaAal2/DJHYR47FSrw8SOGbNVPJS5bT3zyE4B2q0PBcIbrUe4eOmJhgnRilO/Tchl43YVeO/a/tfLFqOJ2pwFa2Rn/ZqY2wQC8NgkV2Fwpv2I/iC7pJmZi105y3F9CVid/M1JdNsggE2e9YjQXRG2ML6FE37oyJCgvBx24QEBDEqPfBQzw3FFPKGRzxKPaZR+gOSTiulHezKNvXy6IxCGrrqbKdGGqK5uGiLK3bVMGKi6gJLNNyNGWFESwqQOUL8Zdl6InlhRzM1UyZ4RhBkATgnK/PFQz8OBEQbSFe6QlAQyFs7UzbuzIio9dViAQ6Op4rhIbKK59ZGUTm813M2CNO7d8IKFNI/XDqknUBO7e+o4WBHyejWez7slvxb+k2L/6lF94fbq+HIQF9/i1aCDvhxkJ85u7SyFlEudUD81XFMUlN/liCuPvRKKEO7dHj87+adPV4Yv7gDdj+G29gbfStL7CK0co6o3MYchk0TEzFs1zLczPSW4hzkFp0KKFOd4c8PTG6XVUW3GI3qb+FJYw+z39EaxEvohaqwUFk4Ap0bTIxHAqstLp/WbId9yyS8t/67GBhv5rRzY3fr+/R7BkYzkogDtrXMN5nnSJw8bMUvgjk6B36aUqV/pQ2VVDIZZKY/NdHmU7iQasQm5D6vNJDRdUbIxxAWX/Broh1kJBDl/IqiHyJM6T8z88vu3lZVRHJABLR7a5OpENUJ/l/IE15YSwgs9o7zSuNmPiqy5fWe25y+rF+UJ1Yn2MUYlPuVrh5ZfbuXC9SE1SwU9+Qw0IyizwI3zl5mEJtsBHwhZ4zxK8wa7m3ZOmwR06S4Ki4s0eHh/BfqIo9zdJXIFVhEPMrnYKId/Yyl/HFF8VHVIFqtCchSZ3v73V1F1XXZ5lLi+ngo6VvfGyeDkGQgPgHZ7/LNij4fLpaneHnhM8ExrUikzLFMG5Y5zHcJo5gir1SASNOXpAT6WIn45ILCIRlZAlFh9goMrXh+oWICWt7bClg/Prei87krqrp4EBj+1WrAimRLCIrVw0i4RZdgWegmf/G8hFEgE7xOIyrHJlN7fVZ+z1d0EcvPSFZ3TNNKkw5BhGU+HuaYSAsanh1SbPq2hO+5A5XLVEp82Nf/c4lzJn52WWtweXO3e+olsXtoBhOzKY8bSMil2vjO34coxbhGoEIbSD2b8m8APMCdPLOvhId/2q/xlRp/vaMCCFOIfMzWjuT9SwOOyprz/eYMRFHlZccZ+3gdqunbD0NzusqnoOTLhee2jPxMzFOnl5zPiVngfyzB8G4UJ+Cq2OONMwD+Qo45XY30TGqM6c41cgXUmMOyOpu4D0p4F3Or21agTQz0JNExvEjLW5hXal2xySAQVqX0aIbGw1r1W91PiIu0vuHzH/X1cgoiOAA3ADcAOAAwADkAOQAyAGEAZAA3AGUAZABmAGEAMgAAABCAYBoMQQBkAG0AaQBuAAAAIhJCAEkAUwBNAEkAWgBIAFgAAAAqDG4AbwBuAGUAfAAAADImVwBpAG4AZABvAHcAcwAgADcAIABVAGwAdABpAG0AYQB0AGUAAABCVnwAQwBfAEYAXwAyADAANAA4ADYALwAyADQAMQAzADYAMQB8AEQAXwBVAF8AMAAvADAAfABGAF8ARgBfADIAMAAzADgAOQAvADIAMAA0ADcAOQB8AAAASABQQFiJCGCJCGiJCHCY5Nh7eAWAAQGKAQMxLjA=<span class="tooltiptext">Click here to copy</span></p></div></td><td style="width: 25%; text-align: right;"><span class="right" style="font-size: 14px; font-weight: bold">IMMINENT SHUTDOWN:<br>------<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00</span></td></tr></table></body></html>
Emails
<b>[email protected]</b>
Extracted
Path
F:\DECRYPT-FILES.html
Ransom Note
<html>
<head>
<script>
function CopyToClipboard(containerid) {
if (document.selection) {
var range = document.body.createTextRange();
range.moveToElementText(document.getElementById(containerid));
range.select().createTextRange();
document.execCommand("copy");
} else if (window.getSelection) {
var range = document.createRange();
range.selectNode(document.getElementById(containerid));
window.getSelection().addRange(range);
document.execCommand("copy");
alert("Base64 copied into the clipboard!")
}
}
</script>
<style>
html{ margin:0; padding:0; width:100%; height:100%; }
body { background: #000080; color: #ececec; font-family: Consolas };
.tooltip {
position: relative;
display: inline-block;
border-bottom: 1px dotted black;
}
.tooltip .tooltiptext {
visibility: hidden;
width: 120px;
background-color: #555;
color: #fff;
text-align: center;
border-radius: 6px;
padding: 5px 0;
position: absolute;
z-index: 1;
bottom: 125%;
left: 50%;
margin-left: -60px;
opacity: 0;
transition: opacity 0.3s;
}
.tooltip .tooltiptext::after {
content: "";
position: absolute;
top: 100%;
left: 50%;
margin-left: -5px;
border-width: 5px;
border-style: solid;
border-color: #555 transparent transparent transparent;
}
.tooltip:hover .tooltiptext {
visibility: visible;
opacity: 1;
}
p#base64{
-ms-word-break: break-all;
word-break: break-all;
-webkit-hyphens: auto;
-moz-hyphens: auto;
-ms-hyphens: auto;
hyphens: auto;
}
p#base64:hover{
cursor: hand;
}
</style>
</head>
<body>
<table style="position: absolute;" width="100%">
<tr>
<td style="width: 25%;">
<span class="left" style="font-size: 14px; font-weight: bold">CODE:
<br>------
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
<br>00000 00000
</span>
</td>
<td style="width: 50%;">
<div style="text-align: center; font-size: 20px;">
<p><s>0010 SYSTEM FAILURE 0010</s></p>
<p>*********************************************************************************************************************</p>
<p>Attention! Your documents, photos, databases, and other important files have been encrypted!</p>
<p>*********************************************************************************************************************</p>
<br>
</div>
<div style="text-align: center; font-size: 18px;">
<p>The only way to decrypt your files, is to buy the private key from us.</p>
<p>You can decrypt one of your files for free, as a proof that we have the method to decrypt the rest of your data.</p>
<p>In order to receive the private key contact us via email: <br> <b>[email protected]</b> </p>
<p>Remember to hurry up, as your email address may not be avaliable for very long.<br>Buying the key immediatly will guarantee that 100% of your files will be restored.</p>
<p>Below you will see a big base64 blob, you will need to email us and copy this blob to us.<br>you can click on it, and it will be copied into the clipboard.</p>
<p>If you have troubles copying it, just send us the file you are currently reading, as an attachment.</p>
<br>
<p>Base64: </p>
</div><div style="text-align: center; font-size: 12px;"><p id="base64" onclick="return CopyToClipboard('base64')" class="tooltip">9GX6wEPpUhnJOuqUjj+/DLA5dujXv6nFT90I29c0ilM8fMNeyJTBzl6SJOTkX++T1WCFrg9V4/+4o4zNFOILFMwAiTvQK7Zxhf4gcOnpzs8rvrhQzxDE7AkQn8s0MXTabeixLGITmqP2sEWShcZWRuJdCc6ugwF5vXLEflwWNuyQiuQGqnO/uvm8l5YdwTISyVpTXJnRJaOP/hkKTRhCid3akqnfsaGTcwNiJGGP/AYp1ZSMzukPlwuLcvIgPBOYI4+fiKFEkNkHG8V1ROh7a+jpVhzFKAyeCMv+ZZF2k8mYdeoWY26Dgw3OGg3a+sLqgTAZtTAt4fp1A7z9RfiHsh5o96Yk0WLHhNB79PmaH05dNtUkwJ66NmESuFI2kETcHs8ZhU3zEyge51mWUSS0FX7JWEiDAthp0cS30e5S4yPjnNFzwMaGr0Kzcehnqwk79GZKf3s7UYOsOF3LS7lPriGpDH/NrQCfdtmtyoRCtFIXMf4BLc68REQaAb8hCkAOjD91+82cgpxRKN39vCcLfJENMRLTgF7O8LmWWvV1QuhCWCa0UfyQ3I8J1I56hU7D9q5K57Etm2+1mHY+R/95xnPo9e+dB8Y1q4/DWgbQmp0zH0/p2ohEOLJoeQG1LFSRXdQ1W7LlO9S8gA9nVBydp+QtTZ2DJRZp5gjdMQvbuYZi+uB8OoSIXp8mp44z3mJ7XjpN4ut+mZlJlLIJV6oAfciYvWwySrQ3Cd7aIgSF90OtX677z/litBWBF9WcSzg+NSvuavjPq9XLOlC6Tod5A8Xq3c4lZuoPkcNLneFjz5Nb5P5XwYmas9syduXQyeVkGNok/758WkbHNI0CXxHXVHR+6lq3ZMc1n7u2hXK+UbEchyJjz2ulzff3Dr/0HtjVGTNBa+HiDe1HGjzGVBY+wAuvnwYGmoNmQj+brQG2UXOoBMNvLeHIFI4ZPvJRmFTNFzSP5r8qyUBAyzBwTY0dkFtMpKqmaaPtREEUxWmZVXxnkcDoU1hkkvQklSzbvwuZqS0TKXbl+q1ezQ9yYaW5hKlGjLmQ64bFr6uoHn+ShXF8IirD5FnbV80m6e9BjPjlIkUMdmyUY0JImQiBwt7EuiEe7UAwPp40iWPmae1WsgwRWctam84lGhE2vAdYWwhq25O21WM3OOOq+JFWHWNcjfx56VZUruiTfXjBipfeV8wqaAohc0n2MZeWI3r+vYz2PING8w3Q6vVFPgFNzQstDPyqjHJ5AyBWrbJw+tD/eJS2keU0XB0YtJZoSeAkQKpur62ffKPj4cbvdVc35+6ylA/0kDQWqyEEveex19oL7YNIE097Gm5dbrTPt3SNSFGfu1EsW3h61nOSBdIvaz50qLfZ/FFJsZPWAvHbv+tkghwhtXtHkXqb/xz754Nrp4DG2+IUBj0qTvZEla9HJI/nBhWurjUTXof0Sm8Dpx6BBqSgXtNol6Piv14ygq9eIIaR5xUmGnIFGpDMyEXxLTta8ZELUJKQqGgUfjCaUYf+entC7LoDLtxwTWy66tE63c7jP3oi7HaMMK5NRVbyl1rWPy4Tz7+M7nKdrIr/I2l6n6I3Lx/4Ov6+gdlnFytAFIzFdmJPxtuZXOuiAKV8mUqsL1eQmBfKVCbroouzPYEIlNWZqPVysXF4FPPlkLlyn+eDNX3XgRzKmnzRFbAHeh1yWHUNnNMk6WnCpN8bvb+XXVRe6K2gYAY8wKEjjOwerDcXYfgKidVUOqijnf0eiljM2vFI9Nvzwm4YZZtWv5jpyLX1z3pwBJAzBkNTBtIAV/dVuFsgk0mqxhQm6m3WCeZRGK2dVQS/oh5b+eELNURZk/6F5YoAxJz4WBH65hOisAvXYkpmAm8c+HDjljIDTYQZwZV/p43LbsBr7mDHqVU9L6FlE2k7+J/PFsPq9UbNYBnwB1EzKhXfH4AbmxdhpDDEVASg1kHGx2VHcIUUy4JLw53tFowQ2g86TplkjBf4TWU5bK5Yz+gaSkOrQlJ7/P2hSPg4U760hy3Pux9GP7aaNjxFEAruVNvDR292hRBnzrAih+94ZA8CvXYNws374NJoXtCKyGO1N9Z35qosO41UAWhRLcD7/o3DSqErdYzQzVIapu47+gOncjTXUfs3PR3ARzqjXSjmaamXlS8piJ0XOu1ZCg7vPe9ZOwp7Da7znTsLeK3F9Lv/e5s0nnNJrU4A/W5K6VhcDlFkYULxK+LtQvnNZA2e5KiG4IsERzWszaN5QVCZWAoiOAA3ADQAZQAwADkAOAA5ADEAZgBhADYANQAzADEAMAAAABCAYBoMQQBkAG0AaQBuAAAAIhJPAEEASQBMAFYAQwBOAFkAAAAqDG4AbwBuAGUAfAAAADIsVwBpAG4AZABvAHcAcwAgADEAMAAgAEUAbgB0AGUAcgBwAHIAaQBzAGUAAABCVnwAQwBfAEYAXwAyADAANAA3ADkALwAyADQAMQAzADYAMQB8AEQAXwBVAF8AMAAvADAAfABGAF8ARgBfADIAMAA0ADIAMQAvADIAMAA0ADcAOQB8AAAASABQQFiJCGCJCGiJCHD9peFyeAWAAQGKAQMxLjA=<span class="tooltiptext">Click here to copy</span></p></div></td><td style="width: 25%; text-align: right;"><span class="right" style="font-size: 14px; font-weight: bold">IMMINENT SHUTDOWN:<br>------<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00<br>00000 00000 0 00</span></td></tr></table></body></html>
Emails
<b>[email protected]</b>
Targets
-
-
Target
1.bin
-
Size
447KB
-
MD5
9823800f063a1d4ee7a749961db7540f
-
SHA1
9d2917a668b30ba9f6b3e7a3316553791eb1c052
-
SHA256
a9524de985a3ecc43e11dd7c051a4bbfe08c3d71cde98ea9bb6ea7f32c0cb174
-
SHA512
c48624e32dba7f08ce0ca8267e541b123c6a9bf848b81d9e62f7fc4bec9b8ed801a6204ffaece4decf0d31bf2595867ff6f8c0b176e366848b61145cc585e41e
-
SSDEEP
12288:Yn+KS3UINuBGCz0SxWUNmH2o8PXwU9Eq7zKloxTwRtjauqCXy3X:Y+FUKWAHNqXwUlzD9w7PqCin
Score10/10-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry
-