General
-
Target
f269d24544e8bb4cb82680bb396a5f1b_JaffaCakes118
-
Size
68KB
-
Sample
240922-t8xb9azapc
-
MD5
f269d24544e8bb4cb82680bb396a5f1b
-
SHA1
8283f4266a7782308b04a3d03c8b13a38eefaa61
-
SHA256
ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097
-
SHA512
c22f51697316c4d29e4b4ef817a1c73d4681fc02b0a2b0fee01e2aaf065d6a3aa04b7defc366cea012a723e600bd80a12083d54bb0907fa0b4cf6f12c41e68d1
-
SSDEEP
1536:7ufJPTAoUei1obcxtZbW3BqlIS2IyUY4h2wEsOolJT+y9F:7upTAneif03BqarUY4l
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\DECRYPT-ejaJxB-decrypt.hta
Ransom Note
<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ejaJxB Decrypt</title><style type="text/css">body { text-align: center; background: rgb(192, 176, 176); color: black; font-family: Arial, Helvetica, sans-serif; font-size: 14pt;}a { cursor: pointer; color: rgb(68, 68, 68);}textarea { width: 90%; height: 200px; background: black; color: white; border: 1px solid black; font-size: 12pt; font-weight: bold;}</style></head><body><h1>ejaJxB Decrypt</h1><h3>All your data has been encrypted with Exorcist 2.0 Ransomware.</h3><h3>Do not worry: you have some hours to contact us and decrypt your data by paying a ransom.</h3><h3>If you don't pay in time, price will be increased. Then, if the payment is still not received, your keys will be destroyed.</h3><h3>To do this, install Tor Browser (here: <a href='https://www.torproject.org/download/'>https://www.torproject.org/download/</a>) and follow instructions on this web site: <a href='http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/'>http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/</a></h3><h3>IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data!</h3><hr><h2>Your authorization key:</h2><textarea readonly>i0knP+Q7tugIBD25IyvkTo4vYmNJJWiS5VwPcHqluyirHasGEijODow/tK38hYW5
8t0o17SN4Yihgw/v+CdBhw6Z0RsBEYCUNzD6jK9H7ZylhsL9U8KOtD9usFkqEZyy
/j8U3KRyv1VBMoAIX5ttHtIqvHhbNOGxxvIbJwbu31AXr3RWSirjy69pYqbGKMNw
bzE80swjkPHBgYRRxF9JuCi7+S6l1gwCrcbAI+WF/HholwD/rKQgOgm2hJAw29qf
+yNXcFALUYHThcDZ3OTbf3Y3qDTlFe+ujupFFytmu00PuKQEFM8L4nmI77rSR3cY
xVj3NI8qcLLke0TI/mRnPXDihqbW8jeM4u7CqU5wHPnUjakzoPtv4rBfxqRtCH7y
48yYzUu/KnMt9rCSAUTFz7/SGTHSxM6j6KWa8eljX0kLtWKcxss1XswGgwY2cObB
LQvc50yWhTl630tNqFSNggheqnW+dLEZYpxZhbRyvN0wOgi6KmFg9r5z/JBUJink
4IDk6ENKRaj6nV+L5kYucuA/65ok4WYjRGQeI1+poyKqlRf7Z5eE1TSjx6uVPmCq
hArBZwekxoHmrdJHPFdLe6H/BKhk/YthyfXKZ46xypoDPDk3CI07MnJmBgPoBUdu
+WgCETHSq2sNt4KVJFkNHpizmMGtcXR1RiUU5SHBfUfWKrBX4Iv0R4uugz6HgBfU
WtXoi1KfO2kwGdAzxV2DcBNLMPHowcTltRwePx8TfEspeomREhZaYcY8VZ/NRpdH
2OXc2VIn7TOHxwgCZaSiFoAW9w4JKGdUxj1Ee0f6spVMygfmMtbfPHk2fwfgMD+Z
ZQ8QPZxY34VVIxn+ysn7dPOSEvOSLNKMJIGKps52aDppKBQ2n4W4BgIXED94INjG
mzUVZxOTDHqnr/TcKSVIPIrwY3BVHprgH9dhu3VFagt5At2d6XZT+ntfJ3lyqczZ
vlGm0w4kW+MZUhutQi95VNqHUlvG1mefYav/6AKrk/ZlQuQL90sTDenX04kOdk7I
qHoZ1ZFk2cJApm3dx+E+08JtF5nUeloPA8cR4iCdtDrbosbWLgt55SiEV++e0JoK
Q9Z3t+KWV26PB1UV6R++UfwVzEFG9bI2c90xXJg3x1O8T309EwYrFKWmjuwuyScn
tWptvXvlaDfF460EL5iOajmkiLooZmvy7PQ0d3jGI1ANq71+ogKecOjoi0OcZINE
n9LEJMnyqfIVI0lhDdiBBCRPhgas8p9Cm9Jcb8QpyDAgvrrMFsnr/KRfDyerfOua
Nelg1Kpwl0yPgecAoDjJHY38iywbF8F30i93zBcaE16N9JBV82dcR/7LOyf/7s9Q
DtTtrdgKXbP96xCx1BEO5Ou+0DyBJowUzA76xuIv9uJXzlqxVuiPtNJyZGryBXD/
EEF+4/4vzEapybXh8rEK39fO+hp/MQflcedcwAsXejHLlJ4nsNFUqYGZRWwH54h5
YOTeP0KrciyN6teWgEtG7YH74OO8vfLqsS4wheeyur4fNqG8lIodhRcaeXbOwOqL
Z7QYyeZCN0JxW/ApgHWRAavI9nWLS2i0lOdsUcJikjLl5d0rKF8xeNzi9RESC20D
qivq8cALdMC49OurtKv16iK7PEN2gq2+trxzBTHhxIuISxn5Eqreh9zJjHznASXa
XqIRz8XJQu6297AbSSXetJ27V+6sCxLxB5kipDyxcqjtlb7l5rHnLozted1wDBD8
63lQh7JoyLQiWo41wsLIQ6auepD5jQX1qfv//9RMNOX8AFvL6KdQ6Ss1FOiklfVz
wmA3R3K9TihFE/wR3KnqMDviGqCDQIfiEzcEbeH47Nbzzv8ZIjml3s0HJsf7T9CV
HBRzoK92IGHI7b45tGy7pZE1kWxx5slwLzYyXu3oWTaLOEogc7HHXqB9zdEvMCqF
aoTmi//JIfKoVLbZRHndNizyoc7b8vikOoSfG11iSAxWbygbprW94oPN5gaoHebH
+PncCPM317QHDnyqwykCiGzTRbBz1z/efau6d7Xuwz9c4hsxQmNi7Kp6CLTPBb+s
GMxieOiHyYnLpERbpVkqYO5A15LjKNqnIhrCNpRh8Ex8wo5Z26/8fOfC44YRMs2y
9g+JTcBuPmD60B7wiJ1/pIm8aI1d4nTcEbSlI2zNUEcvAckAaJc8KG/5nljbTtaE
Auhz73BYuZDxrlIq8dXBlpPzGJawCRmuTgpCwbyK/CoH2zyMDaiA32Iu9Ld0iqRa
IAUHSEcez3y6pJ61/2j8eBsO2Gg/8xohwQ4tmAj3eTBRSKUAvq5+8wXtplh839YC
VV0mJu1rAlFX4rA7vhd87yz3P/Y2oG2eqhWDS6eRGq10jaFT8b0byulqF/cDl4vJ
fPc1mCykKDJza0n9o2IXP0C5b0Y/ECUlP+JLS5/9xOyhvujQbgFa+iclfQKjtO/C
BVCyrFwhQrB6zhyRoJ2eWLruP2ZK8TOLBXC7RmuISiIdbwQde/VIkxZ7eA+NfZDZ
JaAlY+oK1Tv/jGp2scVxQru9HBOXLVnGgDNa7IeFpgfprM51AryuGWtYdwPZqf4Y
vktWp2bJPPFD91K3IqxPCcRe6V6rAA0m1aSQDPz0cvVEOYpF2nhZ+l8BGue91XDf
NZ/igFPFe0AuDRxvrG8aZVVHGKSI80xD/3gfEcoxVrsWqZXan8UEvJ4+fr9Vl2Dy
fwTR0vdW3p+TszE0kd3vjvNxu4KnWjWhCKCx/5UmeBvMrkCKWe12ps4yafBs6pX9
8c7yN3eb0DucUomJF7SlHD37bSk8ZN0jW6ZnqnLVceW4zliCYvrm17bduKLICF1D
16gVaiRRO+XjILYItBVvoQSzRms28Z7FHS3HMq8+pOQl+itDoKHCT8etWraLPX5j
Sr+Mxm+NIeYG2sG1RKkA0ySi2RfvN/9dkVq2eiiPMvydS9gPN/uUzsMRwdhEn99W
QRixmkxfI0FvRxflZo9U0fKu7+qILA4dG6kNKYo89jsEVbl7eEf+Eyh+sPIxVCPO
qT8uQUSQgsXBbExbOg3vXl0xFXOvoewaNmQvjEyXCARFn+9PFqtTSzU6QFYbfUxT
yrMK1bScGSXbDxHDypuC16J2UT+h4PFYBxvyTW/ncOJ/Qq0LheJ5hWsMQ1IgY9W5
6lN0Ci5QnOCoL2q4S9XDBID0EIQcSNUY3SxzJO/d+LQV6hpGnawIOsr1xHU5tIQ7
mA9oIMGURwWWPhpyjnc+k12wDZ2fxwrA7xeefCXK5YNRipN+Hw2Kf6Ag00LWu0uI
VpHlGtn4+qBTGQESmZ4MWtG5+p/D3KTkCkYIWlCRZd38lPzCZVNTU7apVfFmHVpN
BDzMeLqREJ5QakYl7ES1Km3Ty7uvKyY7upPH+iId26WHEPPazvEb2deg475knowP
WahB3YDIRhg1/UMju9AAlBg9GMvutuZnYKS8mK++FtEYVFf+B7YC5x7CiBV7s168
pdfCVi+WKdoCj72c9OOpUGMoaIFD1dU8Kwg8usQYWH7JDsPRvmwQlIBk5nlGEn72
hO+ktUly5zq85z4yfq10FCl0vcM42kw+ilJ+R1eUXSeji4oE/lmUOGtgReUga64N
7YOmg39i3gc6jMvzt3mSGsQZEA/NxgN71dAq9vzcYwAaz3QKSWuKtLb+ujeYtY8o
kuyKs0tXbiETQ7ojFdgMzAwa+44zYqUUl8QNW+MKhaC7JkIXmtKSst5aYP2S2Pd3
vJK6lFTqKOnS47VLqhuPRw8u0l981R6EltFzG1Tin3o2QjWdLw9fKmxoajOX6Kd9
LwL0kUM7lTnIHqZQ1WI31+vw4wRhS0B+An1TrpzkhIZdrVOgFtfjqvKnavnoy1Jb
9hmPv6gq5OBWOQXShV3ZCk7UkP59zvWKDHv565tyXHOBepD62eFp6JuwYpHRRs/5
1P9RlbGQ99/lsCxnGcW/wj+gQLoz+eVAXLE9mJ2lfwR7R2ddBEjqfC970LhcaNwd
nYZ31FKxparPJiPSSYusktzj1a3jdrcsDV/qT5NK0VRDV4Cm4oxIH95/mIoX9TzS
G9j1CM/4CIqZ+PDeEnJBP7xLYMyHTYVaAlBYpBPR6QjTiTP30Aq670u9vz3qZdUp
Fqcx6XnsYqvnYbIuRzd7Y0AYaz0zgisWdFlH2k/EEiC0CmqlpIKU2TpbIjzMbLdP
i6OB/sLqOjgOgsuphvLAB5/UF9jZY/EbjPd/qBUNtagy48JBd/1FEwaNrir9T/DX
oquBbJn0K5lwsPhid4444THitTOSKVldoRR7dFxt5qkQ1ycTQhgINLDYp8owCLnS
sAL6SwrZKh1i5haeMMalavnUHBhO6tiMJpvz4uhhkNUJHYy+lfXsvV2ikbcMIP2x
7Frku2KzUxaLOcrlaxQBizfH34Lw6mHLS6Ca8pSJv+vcsljJ9+XKT5F+vDgwX2fc
AqvTshxFlUrxOGIzuBlnv7dGyZipn3IUJ+8wliHhDzNWzHdXPgYG20/gDeataH87
ivv+K4nchJXY/o+T8domjSdQ04+2Tt5NIYg5TRMcQZ/3oe1cjBGm5uvQswtW9Pj7
KtT3OXYpLzTWf5kzhH6i309dijJgbDQSxl1/3dbKr5Y7wDv+52m12StUrToDuqfS
+BFCDTwTwV6a5yC85LMIVUwAYueha1jky84fguaI8cBDn77pNHPKsYrrKMilFjZI
8G1L2qhoafjWdxEXCCBzZwaQMFwqdR80lqc6VqtjyZdiRR2kVmEhFrGO76wDSEXk
wW9icFQtB7UzrRAhpSi6kN93LyB0y65D717TSPSCjVM7NuGCNdXMHy9bYkK41GPJ
6qrjnPXhO9hG+UcxQikLbaZNN4AqfIhsP59hsiu/a3fNbiDqxuF/2s6hRbv5mmmc
30CMraWW4PfZSnLN9y2OvzJnVruXTTs2GY5Ag5+R/8La5oy5I0KLaOjm0HimDSQv
rtJ3ooO9QBZO3yzkH+HIg7lbmzimLIBsDRY1RMOoWEFNFLVaUbq1nn2yxaEEv9V/
GoWN7mGZeD1d3GOCzWpUrTnNcB/Tqb+jy4w8A2QJ8bpmUBxCOkcZ6aHwY07ZBp3N
</textarea></body></html>
Extracted
Path
C:\Users\Admin\3D Objects\DECRYPT-YMPxsm-decrypt.hta
Ransom Note
<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>YMPxsm Decrypt</title><style type="text/css">body { text-align: center; background: rgb(192, 176, 176); color: black; font-family: Arial, Helvetica, sans-serif; font-size: 14pt;}a { cursor: pointer; color: rgb(68, 68, 68);}textarea { width: 90%; height: 200px; background: black; color: white; border: 1px solid black; font-size: 12pt; font-weight: bold;}</style></head><body><h1>YMPxsm Decrypt</h1><h3>All your data has been encrypted with Exorcist 2.0 Ransomware.</h3><h3>Do not worry: you have some hours to contact us and decrypt your data by paying a ransom.</h3><h3>If you don't pay in time, price will be increased. Then, if the payment is still not received, your keys will be destroyed.</h3><h3>To do this, install Tor Browser (here: <a href='https://www.torproject.org/download/'>https://www.torproject.org/download/</a>) and follow instructions on this web site: <a href='http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/'>http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/</a></h3><h3>IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data!</h3><hr><h2>Your authorization key:</h2><textarea readonly>fsZBwjpZ8YbSWx2j2UT3Xsj6umX+nm0BZGj/IDUR877vaLPqsTMR84ckgTpqo1XH
Yk1JziYnOFXGfY2zqQLq5PGjuC4uEYMubyjKFLlJRvWK2caCH9Wgo3AErvde05Tg
368+Vk35w2SI63pzwqvbeYNX0wFE/bOi5CQymIEpGxtxtjvPXooKxSwpKUm6Di9c
cJB+lbBeL7H4SmX+BrzZi+tVj5X4otsUIyknMdSnMYGoOwPsORSFp5XNgHN8ODi2
qLAUTBMXHnqLwPk5W/Ma8a56gIJf/4tSkB1UvDxCgj2HciihkbKVdbQ0BsfTWZjR
2zE9gJycNDrRZOc0fTjuAbjPRFk5KTH/qdkvupLAHzAp16JqxwEXb2rYkv2sPkx7
fO6LLIQ7vtFrBGwWR7o6cIJyLAac7kBbtBQ+VOdvy+qJjHl2DvvKenhel6nc18pj
z9QmUO4OrM8Rta4T4egGV7n7t7G5y/cZOYJknX7h7vXBQIc9nQCfBBnfA752o5+t
BTQaJkMrcS3ICgCA/9fuZqZn5y1GSPbFEtmFc9SXG5Ln7Wz//cIBx6YuZiWh0RsX
PlMNiR8+NbMb9iRMmr/z8rFdWv5a+JY9sMNjkIInm3vrOfriUnyGBQYz/TzRZW44
Gbs+6BOiEXJ4XNqroLs24uuS7mam8hZ0V6fqGIX8SKQ/SHnBpa5BPC4/MLMv0cF8
Zb3LlDotS1jf2CSBg+3GI98ypLOWsaaMW78Tw9V4qg5qe+dJpVIIquFF/NbgLZAw
NJKUsVz6IOvBosQ56cOpMSkjChWPtb3oE5Lpn2nznjaVM2Xf9HxqQ2nyEeieaWB6
CbiIk44KrmBPXfnGlCN87daL0Z4BH/UNxNoo/Sg6gyHaxtG4PK3cohhexQnREJ+7
bAFUxGmpX1zFRXgXy6eJxsn4W6SnsyKPqvEfJDZodSh+c20AMr27s+kURZzZ5h3J
1BZ81NlzQpOB37ROjg0WnvZAE1MxCEvtr0tCT7ty1Z2CA99X3I27/i2BGLn+lT6b
bvZo/lkLpRxuyh5yggb1SYms2JU9GuQ8EykEjAHd+LyxFyVRT37RmoPxN3mvR5w2
vXqYer6f+QdRv7IJd0OaLSt3F1iOQNqaTw5WnGmeVeZl+WJ7+pkC8i/xt69X/tD8
z0reHtO2ueNEqlTOU1Le80xVAtL6COHFLsUla/EDbXHpsuxaJklNSN0sZw9pT+3Q
YMpwxbPmJhmgy/vzbLJlgwVbtobMp+1VtGimNmyOvt7Zkh4EMxDBMcBAHxnGElD1
TxXOf4ON4mvkgxSXP7HEH3mRyCCtdNz6Oww5rjUyHDkeuTy0mO0tY0ma+L/Y9jB9
0eWdIBrUk7XPjfcRkDFJohJuI3uFpQhGNJKBlZiU43ux+mDWOgTWAVmbYp0Akwl3
0LYYM70v54myx7XwRdFHNph3CCUFvJPBpvtYx0ZOz1f5SdZ8uE7Qt/kyQobWke3p
xtLoSYrkUFqOrh2Un/JKDnHyhLqv65s/9jJ9dVUs3nuGsiLDDFF/2s7Z+xbpKPiQ
rNEv9YIZD3/wKplG5xiN4XF0jLm4KHQ0AGZm25q3evvaA07CZyCAZF33NpsQ65qV
oY7ITlE8ZGV9xNAzNlzXb3ShicMmV8klJuSv1zEZRI33tkYVHbOUXIAiPfvaVXyC
XQAkoMRrmGX/mM/XwOoP2clYGxwxtpPiaFc61AfvHN4eEsw77g1AyzmX7bcyv8Pq
d2brKMS2mK5Mov62RkC5xKBIjNQcDaIXE1FLgiuya8TTxz+/M01fhvXYl8u5wJ2Y
4a6ffceG14t9wg96LM/cs5+hc1xa1k0f/kh6h/5pvg6ER6boqwbw2hHGU/rkkKsm
5xiKFiqwHTYCeNkwZg+ZVb8fXLM/UnfrLd2uFpJK1quOrewNv1dxiQD39uMZVSJZ
DtBC//zLZQuPaGSlUSxVz7AsBbbw6AY0I0gW1LyQSC6mPI4PVcCxKtswHC6juXW8
wEjtR3MEJIQ6eRU9IyhUCS3/SNdrw84ROQCbX1pJ5GfwH5tJe9YvHU1sAijHCxcU
rlDfbWBtAcaTO+kt0XO5Qi4f9GCw/f1QOT1SzySf8Q5wOM9kMURQtfe7JYt0AGqz
ytgODKLmFcNDiq1FR19PTW2wwlNv94Dv7KIQ/1g9i8SddsK8+ipk8L/tB1nEQAOB
pOkX3gzQEq0WO1ARN4bQ536NjFrJQ5C09zCyx2LiwZJTMlfs7LadtL4KJcFcMUjv
IY6JGt7wEcOp9MlVorphJ/bFkKX3lvtnW8I3+Ipb8QE2F63kjN310QCZ+AM0Sop+
pE5h1JNbQ9Uh9kDkfqQLTLCla/vekzE6+wETRSZkohCjTM5blL6pATcZMz++ao/e
Geek2hcwPGcej23J7lySMfegLlmRZDrF6Dv5mv1lhsqwFklEoXOrZ2Kre8Xmjavx
0OwubOQep4uLGN6HMcOi7Yru34LSVADdXBK/Rl80rlOcdpny1fobC9LZErkOaIhc
Mo+FjZ2Bt6yui4EN416VXLSRPGcM4HYbEHYJC13XCq7qKz0LS38dBbJfvpOic1Xz
6efjt1lBBWditWFeheCHHlX2UvIhrSH0jdzhue9Wc+HqndF4m7Ax0j0cksLvf5o7
zS/8arKzGPAG/A0bWYfV+d2QNqV8lcqscCCN6h1uMk/aTC18A4WDe1ZvxW3MMHkO
WgZSkQ6VVv8k3qg+BQDgdRM29vgs1k3IHBJRDWUNiduY8FPOho+BOqAhSb3atfkE
oIDxCdSWqmwkvibYy9iKAkThUSyDzZsB2RB9BUIIb6X3JVXrGda7os0DO/d+Zlzk
Yp+3gPoi2ZmdIEmeSho0AsDJLkNEjY34IPT50OkSITwOV6idVcqw0Zrn3c5KdE1Y
Mab41WlXGa/B9PCp5Bm1+zOmr4uCyHjCqzmdwp+oK5aMFWDmZkAwBYAX9fn1PxOM
yM+dFeDtIwXoXLgh/k9JMTmNZFOR89WWzkgwxT+u2XX11cibiNA27punINTax6jV
H8b9PUeQO35guGROaRDzIsx6RmjleNeso4ge1xS9N4a5t9fIYO217g0zpjwqCJPd
rPA5OluOm/z1kDwv6XG18VdUSFOzJWgHvHIh65YHo3XQTiYbrmExQx32RXd7uVJs
oG2POPDy3IZ+6fqdmamT+AF6JTTAaIbTXHrJyaS3Gi3+KP/0ZwFz9z9Ss8xzsF4C
IyZY/eiO0q2PgHWQ0zXc8ltlHHBXb0gI1F7svhsP46+SIzcWg+v+8su0le5oitX0
p9NEoey4OdsFHePojl97x0R7zmiCj/nsjnj2SF5DlDV6Di/WH7SH4gLEhK29fsS5
RDsvqBc7Q3L5aU9tN66syjxwAWrpS512hao6SzliHr61jVjVfL8mRgBrCjg29EcK
ga+AcVVjhp8LyzMf/4JJs0M47JZss26AdVYhUwe41rMQQu9a4pysaCIrcj9G7V98
jYq1Ie7aP6Z7IAU6kf4nRmwdQwKWHJIjtCjoASNSC32ah6fxMC71/RQXr7mz9Drz
hv8RvaGbkGBZ/+8OvzL0zucztdj8Hpm0Q7AVl6ZHiDD9m60OZPWuhst9FTTafMKZ
V51nWXtn1WtCslQZiyEbKXI8valqa73eETVmS+5oPEdqxYwXzzcxJwpOiC0ejjVI
MVRvVMvkE4EC0uuuxN4eDfUTFsulOQv9/NxEjj6QRXFEN0Vi4psfkQPk5AVrDWgx
e/qfF71nFeyRTg3TC45UdyHI2y35MAqIY8sUHtNezvS3e/evebjUFoPSzGrFKHZT
cfH9+QC1RIu3wvc4ctrsIFRfdZDbq+W65ZNrnAORNziyAeAtauEpXztKIqsEwttp
pDKWTohE6SEpI/Z8NnL9i0iNwtOtfXhewW4Gd8uhdY03wSeZZ19OO4Qgir5hXDyB
qJsymlDQoCgInqY7kPnpMBnHdUJIhsVdWKDcKiRmzPJ5v1ZAY6EfIuFPwLLJGpq1
0/bqoYevQ93Nc7oVP0p8EqZNT/nBYcoeVl0hq+ZQ/lKUG04GO0WntflRq+aDrV41
0zmNPNvAwCHkWmIsDDQylvV7ISr4IsUhvrwEUwCQxdEFOqhcDYBTQ6uR6+fAzrXR
+UYRmFw4y1JwlNMaN8al6XUX+/yOXxtIbSdI/A67wnkFlTlG6r47qp3ZWBMUMVNm
Q+TCxmZHDuCXlj+VMHFaZVAk3bwsuL+IH6CgRW7+R4j0t6AvnFrnR321FMjG2OXK
24xDi+lZeVNRzHV9zBrKnA1IuP+V9kVWyzKSEDLfkavneg1Jep7tjQrtoWacRoTW
LBzj9VZmRaEfSL/mjTMV6imFOtEiSxCXRcoPgtZAIvGGZ7rj2sScM+ib4prioyWd
N2H5B/9R2leQLBG6xSTllRlouzAr5F08RcAFi8o6/NcB4s3LiezMJDlCFii7rf7H
TOg+/epfv3Q64qpTrRlvMSOqjRAffp8Wbc6+G4CFwCqly5aVqGTYmlzGRE6i1pDz
xnUVgL0GT88kUIQ1eb5OeLfM+dt9FNppX1UyHMUWXym11ww3JDo+AtMjo4gYJ2tT
BCPDyz9yFuSCyMb/VOlR17O8jAcuyVKBq+5p21pxWD/EvPJVOe+PIBFxjDNtlere
twJDhE4vTE08/OkhnVtgRLrxjTRCtCw0Dsks2Jr9qCLgRPerNxFdwHP5cBl6z8p8
QzBEENtRcXA9I42GvGZ0si9I6H/Anpyc1Bab8ExDyckar5Y2v7z8GKXLLhBKpW4u
icqvTn9AiSF8S4J5CA9T2r8+F1Wv9wpHQV5cIRiOnXkg9QgVBtF52m7BRLwU5p6y
uWQ88lPas699amFWI5z9MmPksMGAFxdfPUoa22pQS2HrBTThfEVl7cnjhyRgqBGD
oCTEXSVcCo7p520iEx6bEJ4oSG3FRnATmUOlRxCH7aSSsvSsvS0//saA123Mfyxc
u0bkulilCJ29ATKhy3lr2cJuulr+Mv/w6o/N/GRrmadKlH1NWg7aYwSP2fAC1Fjv
y1xo59Gly0d0R+fpoFSc3gUalNxK3qJKwhsnRuyJrDQRoKtfVDCsTSOVHcMcXWSl
</textarea></body></html>
Targets
-
-
Target
f269d24544e8bb4cb82680bb396a5f1b_JaffaCakes118
-
Size
68KB
-
MD5
f269d24544e8bb4cb82680bb396a5f1b
-
SHA1
8283f4266a7782308b04a3d03c8b13a38eefaa61
-
SHA256
ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097
-
SHA512
c22f51697316c4d29e4b4ef817a1c73d4681fc02b0a2b0fee01e2aaf065d6a3aa04b7defc366cea012a723e600bd80a12083d54bb0907fa0b4cf6f12c41e68d1
-
SSDEEP
1536:7ufJPTAoUei1obcxtZbW3BqlIS2IyUY4h2wEsOolJT+y9F:7upTAneif03BqarUY4l
Score10/10-
Exorcist Ransomware
Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (149) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-