eb154e52b2115af5a291fc7ecd320cc5f554c95379fe83e3ce191f0d0476de68

General

Target

eb154e52b2115af5a291fc7ecd320cc5f554c95379fe83e3ce191f0d0476de68
Size

275KB
Sample

240710-hhfq2asfmn
MD5

503768d4b793e197d31dd3a3c207ba04
SHA1

6ee90d4dd2959061a577a964a79e01fa6fdeb8ad
SHA256

eb154e52b2115af5a291fc7ecd320cc5f554c95379fe83e3ce191f0d0476de68
SHA512

c7230db543df254541f4d73e6eb8503b065820da8eaa00d49a98f57dc52545baddb7c4643d89078d3150b62bca280e149202889dc8901329fbe4c92d52c47357
SSDEEP

3072:6R1z8bXh6yyZnCboGSqihQ5Mk/EHCSQ9IiNP8Q1fBLe8vQQ7b8lW76+zGklGT5Ca:6D8bvScRiDH6b/e8/8li3GXuE3y7

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\191719README.txt

Ransom Note

---->Translate this note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help. What can I do to get my files back? You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is 0.0005 BTC. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. In the event of non-payment, all files and browser data in this device will be published in tor websites. you have 48h (2 days). To make sure there is no fraud, you can send 3 of your encrypted files and we will decrypt them for free. To ensure that the decryption is with us Contact Us at Telegram: @anon3621 Email: [email protected]

Emails

[email protected]

Targets

- Target
  
  eb154e52b2115af5a291fc7ecd320cc5f554c95379fe83e3ce191f0d0476de68
- Size
  
  275KB
- MD5
  
  503768d4b793e197d31dd3a3c207ba04
- SHA1
  
  6ee90d4dd2959061a577a964a79e01fa6fdeb8ad
- SHA256
  
  eb154e52b2115af5a291fc7ecd320cc5f554c95379fe83e3ce191f0d0476de68
- SHA512
  
  c7230db543df254541f4d73e6eb8503b065820da8eaa00d49a98f57dc52545baddb7c4643d89078d3150b62bca280e149202889dc8901329fbe4c92d52c47357
- SSDEEP
  
  3072:6R1z8bXh6yyZnCboGSqihQ5Mk/EHCSQ9IiNP8Q1fBLe8vQQ7b8lW76+zGklGT5Ca:6D8bvScRiDH6b/e8/8li3GXuE3y7
Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2