General

  • Target

    info.HTA

  • Size

    9KB

  • MD5

    499520872a558a40fcc479e8ebe845da

  • SHA1

    b47b792d8788d8505d03f9724a44bb128a4d1adc

  • SHA256

    9c917463c0e3916c8a9af5fc8ce648b76916fe037fc414e227bb0e2681bfb65b

  • SHA512

    24a995d85a1fac2b4894f0a1d236498f224e2331dab2a0e77dc625fbd179a91ac36fce11b5fb3a007b4485683b1fb973b1a105037c73a99c61c53826ce470e98

  • SSDEEP

    192:kte8cgF2AxxgZeNE3fnchHfCeSaxiQI5C5ANIr17ahvXT:0xxgZDfncxKeSwnI5C5At

Score
10/10

Malware Config

Extracted

Ransom Note
Can't yo ADoy6nNSSS u find the necessary files? Is the c bwlc5B ontent of your files not readable? It is normal be aK3xDVg cause the files' names and the data in your files have been encryp hcaD7k ted by "Ce AV2 rber Ransomware". It me m2uW ans your files are NOT damage DacHKvYg d! Your files are modified only. This modification is reversible. F SmpA rom now it is not poss ZXtPJnRdz ible to use your files until they will be decrypted. The only way to dec F7T3qssW4 rypt your files safely is to buy the special decryption software "C Z1yvyuss erber Decryptor". Any attempts to rest 78 ore your files with the thir wJacZ d-party software will be fatal for your files! You can proc j6vWhlU eed with purchasing of the decryption softw lQN are at your personal page: If t JKLjKQyo his page cannot be opened cli abNHsR ck here to get a new addr CI ess of your personal page. If the addre Ip ss of your personal page is the same as befo gYA re after you tried to get a new one, you c XHX8P4G an try to get a new address in one hour. At th wS is page you will receive the complete instr 2JkH uctions how to buy the decrypti HoO on software for restoring all your files. Also at this page you will be able to res 1uK4cAx tore any one file for free to be sure "Cerbe U r Decryptor" will help you. If your per 9lFM6Ng sonal page is not availa llHCHiF ble for a long period there is another way to open your personal page - insta 130iEgk llation and use of Tor Browser: run your Inte lNscihL rnet browser (if you do not know what it is run the Internet Explorer); ent oWCgI er or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; wait for the site load nuhuRmPHie ing; on the site you will be offered to do jNURO6Ii wnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; ru fvC9QQZ7Fy n Tor Browser; connect with the butt HTYJ5vKh on "Connect" (if you use the English version); a normal Internet bro aeS9Mi wser window will be opened after the initialization; type or copy the add 0BHVMPy ress http://p27dokhpz2n7nvgr.onion/BDD6-5781-4B4C-0446-9F4B in this browser address bar; pre 87h3kGfB ss ENTER; the site sho qKDEy uld be loaded; if for some reason the site is not lo Tp2gc6tq ading wait for a moment and try again. If you have any pr KHH5qnaBL oblems during installation or use of Tor Browser, please, visit https://www.youtube.com and type request in the searc 7uYadAq h bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. Addit XH ional information: You will fi c nd the instru jRW ctions ("*_READ_THIS_FILE_*.hta") for re r0bz9wM storing your files in any f OHBy older with your enc jV9YzD7oxD rypted files. The instr KafLK uctions "*_READ_THIS_FILE_*.hta" in the f zJWuKDrgHQ older PrJqc s with your encry 9DSwjSndh pted files are not vir 1 uses! The instruc QPLhKT3G tions "*_READ_THIS_FILE_*.hta" will he ywE lp you to dec o5s0NzqKH rypt your files. Remembe Wa8eEnm r! The worst si o tuation already happ nC ened and now the future of your files de pDq9zL0 pends on your determ vcQrwTS ination and speed of your actions. Extracted Path C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected] Family wannacry Ransom Note Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

URLs

http://p27dokhpz2n7nvgr.onion/BDD6-5781-4B4C-0446-9F4B

Signatures

Files

  • info.HTA
    .hta