inc_ransom | 11cfd8e84704194ff9c56780858e9bbb9e82ff1b958149d74c43969d06ea10bd

General

Target

11cfd8e84704194ff9c56780858e9bbb9e82ff1b958149d74c43969d06ea10bd.exe
Size

142KB
Sample

241120-njvt8swmat
MD5

092d39b97288886203fa681bb354cca3
SHA1

baa44b68d92836d9005c6829d6d4891d39e1471d
SHA256

11cfd8e84704194ff9c56780858e9bbb9e82ff1b958149d74c43969d06ea10bd
SHA512

7b77a63b635477bf88934983fabf4103d94aefc95986f4c66df3a74ede2349a6d8c9442f38417dcd5518231ed42104c33273229b3d99c92250cacfd6623c5b47
SSDEEP

3072:uA5ohBykv/QGvx4TOPu5XH4KoUu2JsaO0xiQhzNHaGV:DojR/QY4CP434KrtOiJHFV

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\INC-README.txt

Family

inc_ransom

Ransom Note

Inc. Ransomware We have hacked you and downloaded all confidential data of your company and its clients. It can be spread out to people and media. Your reputation will be ruined. Do not hesitate and save your business. Please, contact us via: http://incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion/ Your personal ID: 938BFE0F7AD109ED We're the ones who can quickly recover your systems with no losses. Do not try to devalue our tool - nothing will come of it. Starting from now, you have 72 hours to contact us if you don't want your sensitive data being published in our blog: http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/ You should be informed, in our business reputation - is a basic condition of the success. Inc provides a deal. After successfull negotiations you will be provided: 1. Decryption assistance; 2. Initial access; 3. How to secure your network; 4. Evidence of deletion of internal documents; 5. Guarantees not to attack you in the future. Instruction how to get to chat page: 1. Download TOR Browser from official website (https://www.torproject.org/download/); 2. Install TOR Browser and open it; 3. Copy chat link and press enter; 4. On the page you will need to register your account using your personal ID; 5. Use this ID and your password to get chat page again.

URLs

http://incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion/

http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/

Targets

- Target
  
  11cfd8e84704194ff9c56780858e9bbb9e82ff1b958149d74c43969d06ea10bd.exe
- Size
  
  142KB
- MD5
  
  092d39b97288886203fa681bb354cca3
- SHA1
  
  baa44b68d92836d9005c6829d6d4891d39e1471d
- SHA256
  
  11cfd8e84704194ff9c56780858e9bbb9e82ff1b958149d74c43969d06ea10bd
- SHA512
  
  7b77a63b635477bf88934983fabf4103d94aefc95986f4c66df3a74ede2349a6d8c9442f38417dcd5518231ed42104c33273229b3d99c92250cacfd6623c5b47
- SSDEEP
  
  3072:uA5ohBykv/QGvx4TOPu5XH4KoUu2JsaO0xiQhzNHaGV:DojR/QY4CP434KrtOiJHFV
Score

10^/10

inc_ransom discovery ransomware credential_access stealer
- INC Ransomware
  INC Ransom is a ransomware that emerged in July 2023.
  ransomware inc_ransom
- Inc_ransom family
  inc_ransom
- Renames multiple (396) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2