4c0fec496abf0c29ef8358d913781b9d0c00e3e53487b72cfbf42753f0aa5176

General

Target

4c0fec496abf0c29ef8358d913781b9d0c00e3e53487b72cfbf42753f0aa5176
Size

700KB
Sample

240618-p77z5sydrr
MD5

4f6dd08aeb0beca7061a2121e2f89f32
SHA1

370de5096d1b9e9ccc2e18e6145dc8170e454d2e
SHA256

4c0fec496abf0c29ef8358d913781b9d0c00e3e53487b72cfbf42753f0aa5176
SHA512

47a73721cdab4f15ef65172bd110f82cc9e887e2d1f333e09b11ddf1213215bcc6f8c04144a8bc7ead53f66572812f5017157dc783df275680ce45a793949c1f
SSDEEP

6144:Er+LuDj/chQaT1ptXl7ml2JcT0RQTPA7b/OQi5J:6+iDjkhQ8NRJcToQTui

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\instruction.txt

Ransom Note

---------------------------------------------------------- YOUR FILES HAVE BEEN ENCRYPTED BY RAPAX RANSOMWARE!!! ---------------------------------------------------------- All your important files have been encrypted and are no longer accessible. The only way to recover your data is by obtaining the decryption key. TO GET THE DECRYPTION KEY, YOU MUST PAY A RANSOM OF 5,000 DOLLARS IN BITCOIN. ---------------------------------------------------------- PAYMENT INSTRUCTION: ---------------------------------------------------------- 1. Purchase Bitcoin in Binance, BitPay, Exodus or Trust Wallet 2. Send the exact amount of 5,000 dollars in Bitcoin to the following address: Bitcoin Address: bc1qdvk0zgyswnwcck55kleepjr8qcr7yhw52sf4y4 3. After making the payment, send the transaction details to the following email address: [email protected] 4. Once the payment confirmed, you will receive the decryption key through email to restore access to your files. ---------------------------------------------------------- IMPORTANT: ---------------------------------------------------------- - Do not rename or modify the encrypted files, this will cause irreversible damage and prevent decryption. - Trying to delete the ransomware will result in permanent data loss. - If payment is not made within 72 hours, the decryption key will be permanently deleted and you will not be able to recover your files. ACT NOW TO RECOVER YOUR DATA!!! - Rapax Ransomware

Emails

[email protected]

Targets

- Target
  
  4c0fec496abf0c29ef8358d913781b9d0c00e3e53487b72cfbf42753f0aa5176
- Size
  
  700KB
- MD5
  
  4f6dd08aeb0beca7061a2121e2f89f32
- SHA1
  
  370de5096d1b9e9ccc2e18e6145dc8170e454d2e
- SHA256
  
  4c0fec496abf0c29ef8358d913781b9d0c00e3e53487b72cfbf42753f0aa5176
- SHA512
  
  47a73721cdab4f15ef65172bd110f82cc9e887e2d1f333e09b11ddf1213215bcc6f8c04144a8bc7ead53f66572812f5017157dc783df275680ce45a793949c1f
- SSDEEP
  
  6144:Er+LuDj/chQaT1ptXl7ml2JcT0RQTPA7b/OQi5J:6+iDjkhQ8NRJcToQTui
Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (167) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2