General
- Target 1.exe
- Size 147KB
- Sample250109-ldly2awkhs
- SHA256 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757
Score
10/10
Malware Config
Extracted
Path
-
C:\5VFg9o5tW.README.txt
Ransom Note
- ------Dear managers!------ If you are reading this, it means your network has been attacked. What does that mean? We hacked your network and now all your files, documents, client database, projects and other important data safely encrypted with reliable algorithms. we also have a copy of all your data. WARNING!!! You don't have to go to the POLICE, etc. Otherwise we will not be able to help you. You cannot acces the files right now. But do not worry. You can get it back! It is easy to recover in a few steps. As proof, we can decrypt any 3 files you provide. We are not interested to ruin your business. We want to get ransom and be happy. Please bring this information to your team leaders as soon as possible. In case of a successfull transaction, we will restore your systems within 4-6 hours and also provide security recommendations. -----------------------WARNING----------------------- If you modify files - our decrypt software won't able to recover data If you use third party software - you can damage/modify files (see item 1) You nedd cipher key / our decrypt software to restore you files. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -----------------------RECOVERY----------------------- Use email: [email protected] Alternative email address: [email protected] ([email protected]) ID message: c5337115f1d1a
Targets
-
- Target 1.exe
- Size 147KB
- SHA256 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757
Score10/10Renames multiple (350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Deletes itself
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
Suspicious use of NtSetInformationThreadHideFromDebugger