locky

General

Target

f974efbf6b643894e4b49b45059f0356_JaffaCakes118
Size

89KB
Sample

240927-bm78hszgqe
MD5

f974efbf6b643894e4b49b45059f0356
SHA1

c7d16c92e93810d548850271090b9f2966afd45b
SHA256

e475d8d45a50f22007579f49e0b79d88ea302d71f429ea1c0f2f8f76f60b9594
SHA512

6ce76c69bf412f0e9f011cc5030fcadfe158c1ee14b73d14cd625b7aff99747817dbdd621a4773963b9fd9cdda47bd21dcca9fb508763981b7fd1300487ba692
SSDEEP

1536:VzO3tEZa/zXqbK0y/1fXbHkBGJ/bhkPj3/gQgHcYhYEdwI+VSvbWFUg:NO3ZqbK061fXbEo/YE

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!!Read_me_How_To_Recover_My_Files.html

Ransom Note

<!DOCTYPE html><h1>#ALL YOUR FILES ARE ENCRYPTED AND STOLEN BY RAGNAROK</h1>Dear Sir Your files are encrypted with RSA4096 and AES encryption algorithm. But don't worry, you can return all your files!! follow the instructions to recover your files Cooperate with us and get the decrypter program as soon as possible will be your best solution. Only our software can decrypt all your encrypted files. What guarantees you have? We take our reputation seriously. We reject any form of deceptionYou can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain any valuable information. Basic price for per computer is $980.Discount 50% available if you contact us in 72 hours, that's price for you is $490. When hiring third-party negotiators or recovery companies. listen to what they tell you. try to think. Are they really interested in solving your problems or are they just thinking about their profit and ambitions? By the way.We have stolen lots of your company and your private data which includes doc,xls,pdf,jpg,mdf,sql,pst... Here we upload sample files of your company and your private data on our blog : http://6ss5vvdhmnhfux6xoerulzuu73ur52v6hcmvaiphohbtgvw2nnzflnid.onion We promise that if you don't pay within a week, we will package and publish all of your company and your data on our website. We also promise we can decrypt all of your data and delete all your files on internet after your payment. Such leaks of information lead to losses for the company. fines and lawsuits. And don't forget that information can fall into the hands of competitors! For us this is just business and to prove to you our seriousness. Our e-mail: [email protected] Reserve e-mail: [email protected] [email protected] Device ID: ==AAA8VM3EjLw4yNyEjLwEDLBZkSIRlQItEL1YUN1QzN0QEM2QEMCVjQBlTRDZEM4gjM4IjMCNDOxMTNxU0NDZjM0EjQFFDODdTOGdzN1UDMCFkQENEMFJTMxIjQ5IjR1MDNFVDM4YDOEJEREFTM2M0QCljMxIDOyEENDZkM5QEOzYUNBVEMGVDRxEDN4YDOyIERwEDR1AzMGhzQ2kjR3QjN5UUOEljMzITQyUTOGRkM2kDN4EEMDNzN0QzQwEkNFJkNzQTO5MTMwYTQ2EUO2YDRGNTO2ADNFFUM0kjMBdTODFkM0AjRBNjRGFER0AzQCJDOCFTODFTO2UERDVkMCRUN3I0QEdjNDNDMyI0NDBzMEdDRFVzQ3EDR1YkRyMEMzITNBlDN2kTQzIENGZjMwMUQ1YzN5UzQGNDMxIENxMEO0kDO4cjNxUTO0EEMClzNEdzNzUTOwQ0QxEkRwMzMyADOzQUQFBTNyQTRGVkR4EENDlDM3IER0MEO5MERwkTMCdDRGNDNyUTN5ETMFVkMFNjRwkzQEBTO2EzNGJDO4IjN3YTRFNUOGNUN0IENyMjNGhTMClTRFhTO0MjQCJ0MGhDM4M0M4cTOzEjR4M0MwkTOzI0N1UUR0ITQxgTR2YUO2Y0MxUTMGNEMxQERBNkNFN0M2ATNCREN3YDOBVzMGhTOBNkNzQDODV0QyUUN5EERxEER1gTRENjNEdzMEVkRzITRxYkMxU0M0IjQyYjNCV0Q1QEM1E0QxITOxUkN4czQxAzNyIERwUzN4gDR4ATNGhjQ0YzM3QkR3MzN3QENxkjNxMkNFVjRyYjM2M0NzEkN0QEOGRUQxMTOCRkRBdDM3AjQFhjR5MUQwYEMyYzMygDRwMDNxU0QBVEM0MjNxETR2IkN3QjM3IUMEVDR1EjQ3cjR3cjQFBTM0MUR3UjRyEEM5ITQBJjMGdTRFZ0N0YUQwkzQDVTM5IjM0gTMDBzNzcDMFZ0N0YDMGJUM2IkQwYkR3gTO3QDRCJ0M2kTR4gTN0E0Q5UDO2cDR5IUQ3MUNwADOzATRzQ0NwAjQGZTQCNzM4EEO3YTOENTOBNkMCZzN5EkMxkTRwcTOxETOCZER4MDM3QkR3QURyUkR2QUQGVkQBNDRwIDODJUMFVzQ0gDR3MDRGVERFFEOFVjM5YzMCRUN3cDRwQTRFdjREFzQBVUNBNkNFNDOwIDMBZTQzAjMFhTMyMkNwYDN4YjMygTOEVkQ0UEM2EkQ0UjM1AjREBjMFBTMBJjRyMTQCFEOxMjQyU0MxkjRwgjNBBjQ0ETOGBTMxEkN5QjNygTOEZURERERxIDRFBjR1U0Q0EDO0MUNyEkNxQTQ4QDM3ATRxYTM5QjM1gDNBdTOGBTN5MUR4cjRxIDR0M0N4MTM1wyQ0MkM5MDRwcTRxIUMBRjRyYkN0kTM1EDRwMTNzYjQwgzM2EDRzYTR1ETOBRTQzUDN1QDRENDRDhjQ0kTOygDN3MUQEBDRyIzM5EDRCR0NBBzMFRkNyIDRyU0MCRzMFBjN0ITODVTNFRTMFZURwYkR4M0NwY0N5gTRyQDMEVkNzADMDRzQyIUMEJjNwEDOzI0N5gjQGRDR1EjQ5MTMCRDN3gzQzYEREVER3UDNBVUOxUkQERjNFFjQykTMCZUM3cTR4gjRyITMCVER3E0Q4UEOyYjMzYUR2UDNEFkQ1cjRClDOBJkR4ETR2QjMDNkQDRER1AzMzMENxUjR0YTMyETRDdjNzQTQzMDNGlzMyQTQ4gjMGVTODRzQyUERxkjQ2gDNBZkRxkjQGV0QFZkMyQ0N2U0N1cDNzYURygjNGBzMBNjR1czQCRDO2cjRwMUQDR0N3YTNCJDNGJTN1EkMyUzQGlzNyIzQzcjMBF0N0AjRGFkR0EUN1QUMBZjN1QENCdzM1MjRENTQDNkRzUzN4IjN3YERzgDN3UUOEhTQCZURGRTO3AjN5QzN2czQ5cDM3YjRDVURxkjN0EjNBZjMGdTM0UTM5YkMwQjQ2QzNBJzMBZUR0IUM1UEN3M0MGdDRxEzQFJjRyYzQEFzM0IEO0QEM4QkMGJDNyYDMwYDM5EDMFNURFZUQwgDMxQ0MzMkN0cDRGRUMBRkNCBjM2UDN0YDO4MUQClzQFVURGNUQElDNxIkM0kDO1UkQCNENBRzN2U0N4kDRBNER4YkQEFEM1YzN3gzMxAzMCFUOCVkMBFjMGFkN5AzQCVUNBBzNGlzQ0ITQzUkREBjRwETO1cjR3MDOyAjM4UjQGRUR1MjNDRjNzcDOFNURDNENyIDR3cTOxgTQCRkREVTNwUkMxgjR5cDRBJkMzIzN0IzN0UDN1QTO2EkQDNUQ0gTNGNDOzUERxADOykzN3QTQDV0MChzMCJUN1EjR4YDMxIkQyE0N2kDR1cjRCZUQ4UkR2ITNCZkMyUURCNkQzMTNyEzQ5IUQCFUQxMDMCJUOGFzN2QTQ2IURzQjRwIjMENENzQUM5UDMyMUNwQUN5EjRGJDOEFENGhjQDZER4QDR3cTQwkDM3QEOCdzNFZUNzUTM1QENyADMxUDOBlDM4IjNFJjNwMUNBBDM0EUM4cDO0YTO4cjR4YUQyMUMFdDRGNEN0kjRCRjQ4MDRyQDNGNTQEVDNykTN2cDMxYUNwETN3QUNDJTNFF0QDlDM5MUMCVUOCNUQ3AzN1YTR1QkM3IDOwIkQyIEMElDM5MEMGZzQDNEMCdjM1ATRCRkR3YjR5IDNycTOENEOykTOBRjMBhTMwQkNGJ0N3YEM

Emails

[email protected]

e-mail: [email protected]

[email protected] Device

Extracted

Path

C:\Users\Admin\Favorites\!!Read_me_How_To_Recover_My_Files.html

Ransom Note

<!DOCTYPE html><h1>#ALL YOUR FILES ARE ENCRYPTED AND STOLEN BY RAGNAROK</h1>Dear Sir Your files are encrypted with RSA4096 and AES encryption algorithm. But don't worry, you can return all your files!! follow the instructions to recover your files Cooperate with us and get the decrypter program as soon as possible will be your best solution. Only our software can decrypt all your encrypted files. What guarantees you have? We take our reputation seriously. We reject any form of deceptionYou can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain any valuable information. Basic price for per computer is $980.Discount 50% available if you contact us in 72 hours, that's price for you is $490. When hiring third-party negotiators or recovery companies. listen to what they tell you. try to think. Are they really interested in solving your problems or are they just thinking about their profit and ambitions? By the way.We have stolen lots of your company and your private data which includes doc,xls,pdf,jpg,mdf,sql,pst... Here we upload sample files of your company and your private data on our blog : http://6ss5vvdhmnhfux6xoerulzuu73ur52v6hcmvaiphohbtgvw2nnzflnid.onion We promise that if you don't pay within a week, we will package and publish all of your company and your data on our website. We also promise we can decrypt all of your data and delete all your files on internet after your payment. Such leaks of information lead to losses for the company. fines and lawsuits. And don't forget that information can fall into the hands of competitors! For us this is just business and to prove to you our seriousness. Our e-mail: [email protected] Reserve e-mail: [email protected] [email protected] Device ID: AAwX0UjLx4yNyEjLwEDLOR0RIRkUB9ELDVTN3gTMFV0NwYTRDlTRxkjRwQERENEO4MTM5cjQyYEOyUUQBhTRDdTR0MjQzMkR2YzQzkDNyUjNDJDM0IDM2UUQENUOyATNyUEM2IUMGJTN3Q0QBJDOzgTO2gTMwUUO5QUN4IzM1QkNGZDOGNzNzkzNFJEOxYDOGFTO4UENBJ0N4EzQFFTM4YDM2UkMDNTOCNUQ2QTQElzQDFEOBRTOyEUQ0ATODJkN2EjN2EkMEVERGRDRwUjN5EDRwMUR5AzQGFjQzQUNwYjMFBTQFFTRyUkQyEEO2IERCVkQwI0M4YjNBVTOBhTNxcTM2kTO4UENzgDN4UERxYDN0QkQzcTNzUzMCR0QFhDOGBTOBBTOEFjMygTO0QTM4MDR3EUNGFjN3EkMCFjM4cTRzIUNwQkQ2EjQBVzNBhDNCVTR1IER5gjNDVTQBljN0QEM4M0N0AzQzMUNFFkNCNENyQUNCJDMFNDNyIzN1gDMBZDMyAzQycDRDZDO5cTMGVjQ2MkNwQ0N2QjMFNkMGdjRCdjM0MER2MTN5IjQGFTNwMUNCFjR0U0QElTOwADRChTNBdjN3EkQ0IDREFDRGNTQCdTO1Y0M1cTQ0U0NGVTQ5E0MBRzM0YDOCdzN4E0QzYUNEFEODlTM5QTRzEjRyMTRCFUN2UER3UzQ0ADR4IUMxkTNChTR5UjMxM0NFZEOCZER4YTRFZUQyYzN4kzQzEkMDVEM1MzQBBDRzMUQDBjN3IDMClTR0UkQDlTOGRjR1MzQ1UzNxYDRzQzQGhzM4MDO4Y0MykjRDJEOBNTMGJEN0ETM2QEOzY0M2EkM2cDRxQkQzQTRxkDMyYzQFNjMyQDOEBTMGlTOBNzNFhjQ5M0N5QUMCdjR5QEMDRUR0QTR4czMxQDMBJkN1cDREhTMxEjRyMTQxY0N2Y0M2gTRxMjQFN0Q1MkM3gTN3cDMBdTQ5EUR1YjQ3UUOwMzNClzNCNkRBRzM0QkRGlTO1YjMCFDRwQzM2UjQ4IUQxQzN3cjMEFEN3EzMyMzM4UkN1QENDFUR4IUQBVUO3IUQxYTO4IENDV0NwYkM3gzQDNkNGJkQEVUOzMzQ0ITO1M0M2M0QwQkMwUDM1UEN5IDR4UTRzEjQEhDNyE0N4YTM0EkM2MkQEBjQ0I0NzcTRERERFJTRGFDRGFjM2AjN0IUQzMDREZEMBZDMyUzQxYkM5EURyEjM3MkNCJUNEVUNwQTRFlTMCZ0MBNTNwIUQFdTRFlzNFhDR1kDOENTQzMUOEJTN1UDM2MTO4UUQwQkMBJTN4gTNGJzQwEDNGNTQGFUQ5ADNzUDRwAzMDBjR3QzN5AjQ2gTOBNDO0gTNBBzMFRTRENzMEJjM3UUQ0MUNywSNyIUMyETQDFTRxMUMwcTMCdjMBJDR1cjRyMkNygjQzMUM4YjRDF0QzgDN2M0NyYERzITMyMTRCFTOFRTNwIzMzQERykjMFFUO5UjQDNzQyYTMFJUNFNTQyM0NwMkNFF0NFVDO2YkNCZDO5kjR3UUM3UDN3kzNFRkM5ETMxQURwQkM3UzM4gTQwYEOxUjMyEUMGRDRGJTNGdzMEV0M1YDOwQkR0YDR4YDN4EUQFVjRDJDR3EkRCdDO3QUQDlDRxY0MxQzQCV0NGRUQDVTNxcTQ1YUR2YjR3MDMwQkM1UUO0UDOBREO2kDM4YjQ3QjMxATQCNTR2MDM0M0QCFUM4QUNxgjR0M0NGdTMycjRzEERBdTNwUzN0UkR1kjQ4kTNwMzN1MkNDBjR1cjRyUjMFJjQzczM4YDM5czQ1MjM2ETO2QTO2YzQ4QDN4EkN1MTR2QzQ2cjRGhTMDlzQBNzMFJEMzUzQxIURFFzQ4cjN1EEOxYkNCNjNEVkREFEN3MER0MkRxQkN1EEOGV0NDF0NEZDRDdjN5QURwETRxgjREZjMGVkRBRURCNkN2EkR4cjQ2EkQ2czMGFDN1kzQ4IkNwUEO3AzNDJUN3EEN1YUQ2IDNzEEODJTOGBzNzQ0N2UTRDVUNwYjQGNEMDR0QwYkQyETO0UTN0AjN1ETQwUkQyY0MwQTR3MTRDRzM4YEO3UjMFVkMCVkQxIjN0UUR5UzQwkTM5MEO0E0MBFTQzITNyEUNFlTN3AzMFRjNFlDMCVDMFZENGlTQCdzM4IzMwkzQCJkMChjQFZkNzEDNBdzM2AzQzQUOwATQEljQ5YzQwYjNxEUQFRDNDhTN1cDR5AjQ1IjM2cDMEBTR5EEM3AzNDhzMGFjQ4YTM1M0QzIUOBJTMBZTM2Q0NBZzQyITQDNDR2gjNFBTQCRUMxE0QwMDNDVEOBNTQBR0Q3MDMyUTRENTQ5czN5ATN5EkMzEEO4QTMycjRDZTR5UUQwMEOEN0NCJUQzYDMGZUO3cTRyQDM2AzNBJkN1YUMBJUO1EkQ3gTNyEzQDZkR4MTOCFTR4EUMBdjQwMEOBhjQFFEOxUjQ0cTNElTNzIkM3kjQwUjR3YUQFdjMzEUNBhjN1QTQycTM0EDO1Y0N1kzQ3QjQ2cDMwQEN1EDNGFzQCZTQ1YTN4IEOBBTM4MEO0gDMCFzM0UUMCV0QxEENDRzQxMTMyQjRBRzNzkzNzYzQ1UUNDNkQFV0MxQEMzEEO4QEO1QjQxQDOzEDNCZDO4QkN0U0M0IUN5gzMxQUOBR0N1ATRGZTNBJzNFZDOGJkRDVDN0MDMzkzNyUURDJjR0cDR1IkQ1ADOGBTOBNUM3UTN5UDM3YkNzYkRFVTO

Emails

[email protected]

e-mail: [email protected]

[email protected] Device

Targets

- Target
  
  f974efbf6b643894e4b49b45059f0356_JaffaCakes118
- Size
  
  89KB
- MD5
  
  f974efbf6b643894e4b49b45059f0356
- SHA1
  
  c7d16c92e93810d548850271090b9f2966afd45b
- SHA256
  
  e475d8d45a50f22007579f49e0b79d88ea302d71f429ea1c0f2f8f76f60b9594
- SHA512
  
  6ce76c69bf412f0e9f011cc5030fcadfe158c1ee14b73d14cd625b7aff99747817dbdd621a4773963b9fd9cdda47bd21dcca9fb508763981b7fd1300487ba692
- SSDEEP
  
  1536:VzO3tEZa/zXqbK0y/1fXbHkBGJ/bhkPj3/gQgHcYhYEdwI+VSvbWFUg:NO3ZqbK061fXbEo/YE
Score

10^/10

locky defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware
- Locky
  Ransomware strain released in 2016, with advanced features like anti-analysis.
  ransomware locky
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (174) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Blocklisted process makes network request
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2