ouroboros | 150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc

General

Target

JaffaCakes118_b5fcddeec6422bec63cbd59d4d0aaeab
Size

1.3MB
Sample

250109-bb8pxa1lfs
MD5

b5fcddeec6422bec63cbd59d4d0aaeab
SHA1

2fb1cbec471ba7f0859e2a804e4cd51fb6b0be54
SHA256

150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc
SHA512

825706455bcfcbfe9186f9030229f8d6aa64555803ff2f0ff8723f05b50511e9d889e4a8ebc2bbffff573930b07fe6b41b577d43262490032646d01d47918c55
SSDEEP

24576:XN4EfsPHd9VbyiKSnKMnsNneRWrN2jHwTxbMmgCyq3eca44zpRPtHS:9z0/0iKSnKYsNn4WZ2LwQNGeca4aPl

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Decrypt-info.txt

Ransom Note

All your files are encrypted due to security problem with your computer. You should pay money to recover your files. The price depends on how fast do you message us. You should contact us via this email address: [email protected] if you didn't receive any reply, message our second email address: [email protected] We guarantee that if you make payment, all your files will be recovered. You can send few example files. We recover them for you to prove that we can recover your files. Attention: Do not rename encrypted files. Do not try to decrypt your data using third-party software, it may cause permanent data loss. The decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.) Attach "C:\ProgramData\prvkey1.txt.key" file with your email. Do not delete this file, it causes permanent data loss.

Emails

[email protected]

Targets

- Target
  
  JaffaCakes118_b5fcddeec6422bec63cbd59d4d0aaeab
- Size
  
  1.3MB
- MD5
  
  b5fcddeec6422bec63cbd59d4d0aaeab
- SHA1
  
  2fb1cbec471ba7f0859e2a804e4cd51fb6b0be54
- SHA256
  
  150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc
- SHA512
  
  825706455bcfcbfe9186f9030229f8d6aa64555803ff2f0ff8723f05b50511e9d889e4a8ebc2bbffff573930b07fe6b41b577d43262490032646d01d47918c55
- SSDEEP
  
  24576:XN4EfsPHd9VbyiKSnKMnsNneRWrN2jHwTxbMmgCyq3eca44zpRPtHS:9z0/0iKSnKYsNn4WZ2LwQNGeca4aPl
Score

10^/10

ouroboros pandastealer discovery evasion persistence privilege_escalation ransomware spyware stealer upx
- Ouroboros family
  ouroboros
- Ouroboros/Zeropadypt
  Ransomware family based on open-source CryptoWire.
  ransomware ouroboros
- Panda Stealer payload
- PandaStealer
  Panda Stealer is a fork of CollectorProject Stealer written in C++.
  stealer pandastealer
- Pandastealer family
  pandastealer
- Renames multiple (657) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2