dbfbc98581c82723ed3c35b156ef0924fad11271e0c3c6c6b8447e7e02b05a5d

General

Target

275d0d15fa3582e848f05daa76d351e10ce3d7072e9c987eee1a1f606c714a97.zip
Size

46KB
Sample

240705-g9jfkawfnc
MD5

4ba0d6c24563460828aaec7878d5b137
SHA1

97f5833d72499a6a0c4860ad127a7dabc9c64e00
SHA256

dbfbc98581c82723ed3c35b156ef0924fad11271e0c3c6c6b8447e7e02b05a5d
SHA512

ef275a477116473c6622ab80dbc8c41dee152b43b79641cd16dde0f53b1413cfee42748769ef3b3fb380f5dc2b36f57d6f9153ea407c41a2f67b6418b52a5f90
SSDEEP

768:NLpRbgdO/5VFJ2zU9EA+kzkVreP3m9AHUVUdJzzZohahucHTCn:/REOZNQFef06dxa0ASTA

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README.hta

Ransom Note

<!DOCTYPE html> <html> <head> <title>SORCERY RANSOMWARE NOTE</title> <style> body { background-color: black; color: green; font-family: Arial, sans-serif; } .important { color: red; } h1, h2 { color: red; } </style> </head> <body> <h1>SORCERY RANSOMWARE NOTE</h1> <h2>What happened?</h2> <p>All of your files are encrypted and stolen. Stolen data will be published soon on our Tor website. There is no way to recover your data and prevent data leakage without us. <span class='important'>Decryption is not possible without the private key.</span> Don't waste your and our time trying to recover your files on your own; it is impossible without our help.</p> <h2>What is Ransomware?</h2> <p>Ransomware is a type of malicious software that encrypts your files and demands a ransom payment to restore access to them. Once your files are encrypted, you will not be able to open or use them without a special decryption key. In addition to encrypting your files, ransomware can also steal your data and threaten to publish it if the ransom is not paid.</p> <h2>What is a Decryptor?</h2> <p>A decryptor is a tool that can reverse the encryption applied by ransomware, allowing you to regain access to your files. The decryptor requires a unique private key, which is held by the attackers. Without this key, it is impossible to decrypt your files.</p> <h2>How to recover files & prevent leakage?</h2> <p>We promise that you can recover all your files safely and prevent data leakage. <span class='important'>We can do it!</span></p> <h2>Contact Us</h2> <p><span class='important'>Email:</span> [email protected]</p> <p><span class='important'>Enter DECRYPTION ID:</span> S10</p> <p>You need to contact us within <span class='important'>24 hours</span> so that we can discuss the price for the decryptor.</p> </body> </html>

Emails

[email protected]</p>

Targets

- Target
  
  275d0d15fa3582e848f05daa76d351e10ce3d7072e9c987eee1a1f606c714a97
- Size
  
  49KB
- MD5
  
  c2734e516454c7af7354a7a4d25cdfa1
- SHA1
  
  ad062ffc6cc642ed47549f172e085c15e4902466
- SHA256
  
  275d0d15fa3582e848f05daa76d351e10ce3d7072e9c987eee1a1f606c714a97
- SHA512
  
  dc32973cbe1b12f27c9d78702f8efb307f48f521529d0ad4cd70426bfcacb697a3dd761246cc7bd40235c51d7b1bced2eeee78bd7ac82ad297c314a80d753367
- SSDEEP
  
  1536:dQFgpLzLiugEBVw9wrLM+7UUjl0FSrXaN:CF4zLi9EBpg+3XaN
Score

10^/10

defense_evasion execution impact persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (173) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2