369034bf1d793fe56ea4d683a156722d825ad9829fc128117f82a26bc1d0480b

General

Target
369034bf1d793fe56ea4d683a156722d825ad9829fc128117f82a26bc1d0480b
Size 81KB
Sample241019-rmtywssdkl
SHA256 369034bf1d793fe56ea4d683a156722d825ad9829fc128117f82a26bc1d0480b
MD5 abc78bf584bd59ad6653649c0299d8ab
SHA1 1ed8df084e23ecb429e67bc8840d8a99495ce5ab
SHA512 5d1cdc387a0e698f027b0df99c92cf4740087c272b099a82b6c821c9b502c2aceba965eb620e236eaac306e64e408f7ab9484753d90a39dd8894bb89dc57bead
SSDEEP 1536:83dL3a+DwmXtsSjMDiMq74mzjLdDH/ZFaCthtRa3t:EdL3HwKtsMMDjCjFXXrRa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery ransomware

Malware Config

Extracted

Path

C:\ProgramData\README.TXT

Ransom Note

I'll try to be brief: 1. It is beneficial for us that your files are decrypted no less than you, we don't want to harm you, we just want to get a ransom for our work. 2. Its only takes for us at list 20 minutes after payment to completely decrypt you, to its original state, it's very simple for us! 3.If you contact decryption companies, you are automatically exposed to publicity,also, these companies do not care about your files at all, they only think about their own benefit! 4.They also contact the police. Again, only you suffer from this treatment! 5. We have developed a scheme for your secure decryption without any problems, unlike the above companies, who just as definitely come to us to decipher you and simply make a profit from you as intermediaries, preventing a quick resolution of this issue! 6. In case of refusal to pay, we transfer all your personal data such as (emails, link to panel, payment documents , certificates , personal information of you staff, SQL,ERP,financial information for other hacker groups) and they will come to you again for sure! We will also publicize this attack using social networks and other media, which will significantly affect your reputation! 7. If you contact us no more than 12 hours after the attack, the price is only 50% of the price afterwards! 8. Do not under any circumstances try to decrypt the files yourself; you will simply break them! Contacts Download the (Session) messenger (https://getsession.org) in messenger :ID"0585ae8a3c3a688c78cf2e2b2b7df760630377f29c0b36d999862861bdbf93380d" MAIL:[email protected]

Emails

MAIL:[email protected]

URLs

https://getsession.org

Targets

- Target
  369034bf1d793fe56ea4d683a156722d825ad9829fc128117f82a26bc1d0480b
- Size 81KB
- SHA256 369034bf1d793fe56ea4d683a156722d825ad9829fc128117f82a26bc1d0480b
- MD5 abc78bf584bd59ad6653649c0299d8ab
- SHA1 1ed8df084e23ecb429e67bc8840d8a99495ce5ab
- SHA512 5d1cdc387a0e698f027b0df99c92cf4740087c272b099a82b6c821c9b502c2aceba965eb620e236eaac306e64e408f7ab9484753d90a39dd8894bb89dc57bead
- SSDEEP 1536:83dL3a+DwmXtsSjMDiMq74mzjLdDH/ZFaCthtRa3t:EdL3HwKtsMMDjCjFXXrRa
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery ransomware
- Renames multiple (7093) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2