targetcompany | 8c4731c1fbf49ef59d696d72db1aa2576e422ff788c4cc65d19a916a307b8581

General

Target

8eb32de1ec33ffaf2add6719d3bbc2576bc468086252c12efd8b5dcc5e44699f.zip
Size

812KB
Sample

240627-nyjqhszcne
MD5

f7247e6e072ae9833f58beb6dde66ba1
SHA1

a5fb7db4c757d641458621eaf9e8b9f37d0d83bd
SHA256

8c4731c1fbf49ef59d696d72db1aa2576e422ff788c4cc65d19a916a307b8581
SHA512

97d21d9fe46ae43e0d044f6694124df5550a6b2bae7b16eb62f2fc8f65b2ffedb7abe103cbc1196cd53870ba2585634ef9bcdd71db2974a035d195ff1eb2af3c
SSDEEP

24576:5km2mjT4FmaXVfTR2IMucOWPECTG/aR4zjag:qmT4zX2IMuhWsCTGSRMGg

Score

10^/10

Malware Config

Extracted

Path

/run/initramfs/HOW TO DECRYPT.txt

Family

targetcompany

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: E66EC1A7A58C72459ADC9D37 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

- Target
  
  8eb32de1ec33ffaf2add6719d3bbc2576bc468086252c12efd8b5dcc5e44699f
- Size
  
  1.9MB
- MD5
  
  121f43dfb68b710165ec47b2e102b50c
- SHA1
  
  dffa99b9fe6e7d3e19afba38c9f7ec739581f656
- SHA256
  
  8eb32de1ec33ffaf2add6719d3bbc2576bc468086252c12efd8b5dcc5e44699f
- SHA512
  
  6d7d62265b852e7adfcf5903f8b7a6c3cd0329a0d95a5e1a70897775da4e77fd125ba1949c06b2386fbfccbfd713a34c6f014ba92c41d55274f34f767d38945e
- SSDEEP
  
  49152:GRooXHbhpWDbkVdmAxURyLAlLcbxY9CE5r9:toXzmSURyCxx
Score

10^/10

targetcompany persistence ransomware
- TargetCompany,Mallox
  TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
  ransomware targetcompany
- Renames multiple (320) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence
behavioral1