Overview

overview

10

Static

static

3

7c2dbad516...d1.exe

windows7-x64

10

7c2dbad516...d1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c2dbad516d18d2c1c21ecc5792bc232f7b34dadc1bc19e967190d79174131d1

  • Size

    55KB

  • Sample

    240704-lpn8javcjj

  • MD5

    a35596ed0bfb34de4e512a3225f8300a

  • SHA1

    aeb09e894736cbb41e934f83cca0247fe89d8a19

  • SHA256

    7c2dbad516d18d2c1c21ecc5792bc232f7b34dadc1bc19e967190d79174131d1

  • SHA512

    e70eccbbe84f933a567b000fceba9666f4537489de0ed21eb3bdaf06cfb61b618be042d566969100907f06ea68aa2da1b84029d94c73f971ea35af9de968e3de

  • SSDEEP

    1536:gZVYb2bbBisyEcPC00h7sBvvKk+jTc7+T8l7RJV62CzVDL+oWB27evMCUQ:EV+GiVEc6RsMJQ

Score
10/10
deathransomransomware

Malware Config

Extracted

Path

C:\Recovery\fc26e022-289f-11ef-a973-46d84c032646\read_me.txt

Family

deathransom

Ransom Note
--= DEATHRANSOM =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email [email protected] [email protected] Your LOCK-ID: PrYt3/gVmjlQQQeXI98r9wGn3Apf6ZLKtskQdBBmwkGv3HPcDgB1Q1/vkJd9KDsjBEJMMj/PQk418TsFOf5miJedGK2RBeuSwPoE6IVgv3KGaiLWaqfHSbE+X4Wuz2lrfVyklpQ95MG49Xm7D6grQjpoor+ywtVt9fr6qvarKI4bJp6hEztdlVVaUMmqN/Cn4TdNoNtwy1HAoJ0j2M2Tzn7/BqFrnn+ir2eT77ZAa+lZJO2ElLCuC4XIO5f9FZL3leZzjPr336S49hQOUb6zReqXeZItZeWxkf9oTiURrmuA5yuvlBorYyw1QmKMTuHmRSxv+x9UDm5G78Rtk1PrfO3aobRSY3PB/QW9q0jhwwlK7GDvA/nvLNLsnT4OkSNvac7K2n8RjAnu7WC6AQpMGnnwDM1djdqRCBr6eezoRpykqwljeyCNgsI3LVNdekWvyqXjvN7KKLf4aIqx1mewC2AqCTQ+7YlGzKuCxv/t9e6n/8tU8pymUGOqeSqeO5dtUKiyV1WEOaMX3g84NoxxIO0TcHIExaheibUmhbI3oJvVTRsTE/4fQumlgZwRElgm9Mp7p1OQkx7TmQSpBLWoK2hgyAIdn/8GNOq7/WUoyXSLelc8Bm7tg88th6UH+7tEy+4JUEh2XarPk4HF/gira2LI6v71TVucriHKMtWz5YFbwyPEFqHIUCT+zZtryGbTwBYZ8RKd3kDoYT1nGhdodA== >>>How to obtain bitcoin: The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ >>> Free decryption as guarantee! Before paying you send us up to 1 file for free decryption. We recommeded to send pictures, text files, sheets, etc. (files no more than 1mb) IN ORDER TO PREVENT DATA DAMAGE: 1. Do not rename encrypted files. 2. Do not try to decrypt your data using third party software, it may cause permanent data loss. 3. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Path

C:\Users\Admin\3D Objects\read_me.txt

Family

deathransom

Ransom Note
--= DEATHRANSOM =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email [email protected] [email protected] Your LOCK-ID: +1EZm4GZmyLaV34vl5uw5PZv2g0u9VgLrQzt4czgpDdwwuI8O8XrZGFjX8BrwUK88beeM3SGZwkCU+hV8W7aEoUa8thiMCvf+WWbf5REeO8vtL4Nv4NPCSUtN/MNACQxpPyyUm1/sIPFrNxYholqlB7amB2oaWdyAy2JNXUQM3+7K1F7fzEo4j2Ci63dzD903DYsZI+46tP3IxcoaM0/eM2F+j38GYziv2N9O8Uv+iWFyWTa9caClGCW0iYl1rlxUoLfS9GlqY+ogOyuEWFIg6vyg4vn4qB4FmkU21RsT9YqsiavC7dzof/3jYlb5ClN2stCZ+LE6d+YLg8bROEqCI+UIDHmi3Pzd6VNjw70ZM9RLIYAzUzMaQnfOUz0ssVmzfxanxbVnovEDTMRVgmn0ag4va1d3b+XJU89g2RQuwf9bbLkMkqIi5jruUhVABsqTTHRkR0D7W0qwFcTT4oB8yL9sHxfNo0rmuKhOKyBETnKL2BCbEv3dHdbK91yBROM+/N9kArdctj7GsZsBkq2wqjUbBdx0NvOnk2AFYYqWOQGG6Ny3spJ3C6H8qkEJo6jHbAMA4iWLN9C5Nx1JTPnX09QuEmRfqbhHivliszWZytd77mx2i0Bp/vJcTY4DZ4FSq4wqb/8BBW/Ab/zicBeNUJGE/eOBS+76JRLDvAAI0FIExlGp1Qj0l5i7toh1xA9yYhn4oLJ5RMZc9s01RMOVA== >>>How to obtain bitcoin: The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ >>> Free decryption as guarantee! Before paying you send us up to 1 file for free decryption. We recommeded to send pictures, text files, sheets, etc. (files no more than 1mb) IN ORDER TO PREVENT DATA DAMAGE: 1. Do not rename encrypted files. 2. Do not try to decrypt your data using third party software, it may cause permanent data loss. 3. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target

      7c2dbad516d18d2c1c21ecc5792bc232f7b34dadc1bc19e967190d79174131d1

    • Size

      55KB

    • MD5

      a35596ed0bfb34de4e512a3225f8300a

    • SHA1

      aeb09e894736cbb41e934f83cca0247fe89d8a19

    • SHA256

      7c2dbad516d18d2c1c21ecc5792bc232f7b34dadc1bc19e967190d79174131d1

    • SHA512

      e70eccbbe84f933a567b000fceba9666f4537489de0ed21eb3bdaf06cfb61b618be042d566969100907f06ea68aa2da1b84029d94c73f971ea35af9de968e3de

    • SSDEEP

      1536:gZVYb2bbBisyEcPC00h7sBvvKk+jTc7+T8l7RJV62CzVDL+oWB27evMCUQ:EV+GiVEc6RsMJQ

    Score
    10/10
    deathransomransomware

    • DeathRansom

      Ransomware family first seen at the start of 2020. Initial versions did not actually encrypt files.

      ransomwaredeathransom

    • Renames multiple (174) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks