Resubmissions

26-01-2025 11:49

250126-nzgbsa1rgn 10

26-01-2025 11:48

250126-nygwxszrdz 10

General

  • Target

    LoaderFuscate.exe

  • Size

    13.9MB

  • Sample

    250126-nzgbsa1rgn

  • MD5

    c07637410f1d07d4fd69030fac313a7f

  • SHA1

    72a944ca04c28d7d651468b082ba1630900272e0

  • SHA256

    7880389d89e8e28cbf6ac18bfb40dc8661dec9d9723e97b14bea6f8dff91804b

  • SHA512

    747ebeceacf1342bee878ca9aa141b3939c309eee4c14dad3c9ab3f5a7affef45adff9ffc88c7e73368eb7fb3239a242845d4acbd3a3cf5ae94f403209d6393c

  • SSDEEP

    393216:pV2YFanmL01+l+uq+VvyUR9LrvF1+TtIiLCS9DNsIRfamd:XE601+l+uqgvyO9fd1QtIQ9iIdd

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (traditional).wnry

Ransom Note
{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;} {\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;} {\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;} {\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;} {\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;} {\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;} {\fhiminor\f31506\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\fbiminor\f31507\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f540\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} {\f541\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\f543\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\f544\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\f545\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} {\f546\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\f547\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\f548\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\f550\fbidi \fswiss\fcharset238\fprq2 Arial CE;} {\f551\fbidi \fswiss\fcharset204\fprq2 Arial Cyr;}{\f553\fbidi \fswiss\fcharset161\fprq2 Arial Greek;}{\f554\fbidi \fswiss\fcharset162\fprq2 Arial Tur;}{\f555\fbidi \fswiss\fcharset177\fprq2 Arial (Hebrew);} {\f556\fbidi \fswiss\fcharset178\fprq2 Arial (Arabic);}{\f557\fbidi \fswiss\fcharset186\fprq2 Arial Baltic;}{\f558\fbidi \fswiss\fcharset163\fprq2 Arial (Vietnamese);}{\f880\fbidi \froman\fcharset238\fprq2 Cambria Math CE;} {\f881\fbidi \froman\fcharset204\fprq2 Cambria Math Cyr;}{\f883\fbidi \froman\fcharset161\fprq2 Cambria Math Greek;}{\f884\fbidi \froman\fcharset162\fprq2 Cambria Math Tur;}{\f887\fbidi \froman\fcharset186\fprq2 Cambria Math Baltic;} {\f888\fbidi \froman\fcharset163\fprq2 Cambria Math (Vietnamese);}{\f910\fbidi \froman\fcharset238\fprq2 Cambria CE;}{\f911\fbidi \froman\fcharset204\fprq2 Cambria Cyr;}{\f913\fbidi \froman\fcharset161\fprq2 Cambria Greek;} {\f914\fbidi \froman\fcharset162\fprq2 Cambria Tur;}{\f917\fbidi \froman\fcharset186\fprq2 Cambria Baltic;}{\f918\fbidi \froman\fcharset163\fprq2 Cambria (Vietnamese);}{\f950\fbidi \fmodern\fcharset238\fprq1 Consolas CE;} {\f951\fbidi \fmodern\fcharset204\fprq1 Consolas Cyr;}{\f953\fbidi \fmodern\fcharset161\fprq1 Consolas Greek;}{\f954\fbidi \fmodern\fcharset162\fprq1 Consolas Tur;}{\f957\fbidi \fmodern\fcharset186\fprq1 Consolas Baltic;} {\f958\fbidi \fmodern\fcharset163\fprq1 Consolas (Vietnamese);}{\f1072\fbidi \fmodern\fcharset0\fprq1 GulimChe Western;}{\f1070\fbidi \fmodern\fcharset238\fprq1 GulimChe CE;}{\f1071\fbidi \fmodern\fcharset204\fprq1 GulimChe Cyr;} {\f1073\fbidi \fmodern\fcharset161\fprq1 GulimChe Greek;}{\f1074\fbidi \fmodern\fcharset162\fprq1 GulimChe Tur;}{\f1077\fbidi \fmodern\fcharset186\fprq1 GulimChe Baltic;}{\f1082\fbidi \fmodern\fcharset0\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Western;} {\f1080\fbidi \fmodern\fcharset238\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc CE;}{\f1081\fbidi \fmodern\fcharset204\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Cyr;}{\f1083\fbidi \fmodern\fcharset161\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Greek;} {\f1084\fbidi \fmodern\fcharset162\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Tur;}{\f1087\fbidi \fmodern\fcharset186\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Baltic;}{\flomajor\f31508\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} {\flomajor\f31509\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\flomajor\f31511\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\flomajor\f31512\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;} {\flomajor\f31513\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\flomajor\f31514\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\flomajor\f31515\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;} {\flomajor\f31516\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\fdbmajor\f31520\fbidi \fmodern\fcharset0\fprq2 Malgun Gothic Western;}{\fhimajor\f31528\fbidi \froman\fcharset238\fprq2 Cambria CE;} {\fhimajor\f31529\fbidi \froman\fcharset204\fprq2 Cambria Cyr;}{\fhimajor\f31531\fbidi \froman\fcharset161\fprq2 Cambria Greek;}{\fhimajor\f31532\fbidi \froman\fcharset162\fprq2 Cambria Tur;} {\fhimajor\f31535\fbidi \froman\fcharset186\fprq2 Cambria Baltic;}{\fhimajor\f31536\fbidi \froman\fcharset163\fprq2 Cambria (Vietnamese);}{\fbimajor\f31538\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} {\fbimajor\f31539\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\fbimajor\f31541\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\fbimajor\f31542\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;} {\fbimajor\f31543\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\fbimajor\f31544\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\fbimajor\f31545\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;} {\fbimajor\f31546\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\flominor\f31548\fbidi \froman\fcharset238\fprq2 Times New Roman CE;}{\flominor\f31549\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;} {\flominor\f31551\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\flominor\f31552\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\flominor\f31553\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} {\flominor\f31554\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\flominor\f31555\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\flominor\f31556\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);} {\fdbminor\f31560\fbidi \fmodern\fcharset0\fprq2 Malgun Gothic Western;}{\fhiminor\f31568\fbidi \fswiss\fcharset238\fprq2 Calibri CE;}{\fhiminor\f31569\fbidi \fswiss\fcharset204\fprq2 Calibri Cyr;} {\fhiminor\f31571\fbidi \fswiss\fcharset161\fprq2 Calibri Greek;}{\fhiminor\f31572\fbidi \fswiss\fcharset162\fprq2 Calibri Tur;}{\fhiminor\f31575\fbidi \fswiss\fcharset186\fprq2 Calibri Baltic;} {\fhiminor\f31576\fbidi \fswiss\fcharset163\fprq2 Calibri (Vietnamese);}{\fbiminor\f31578\fbidi \froman\fcharset238\fprq2 Times New Roman CE;}{\fbiminor\f31579\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;} {\fbiminor\f31581\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\fbiminor\f31582\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\fbiminor\f31583\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} {\fbiminor\f31584\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\fbiminor\f31585\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\fbiminor\f31586\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}} {\colortbl;\red0\green0\blue0;\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0; \red128\green0\blue128;\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192;}{\*\defchp \fs22\loch\af31506\hich\af31506\dbch\af31505 }{\*\defpap \ql \li0\ri0\sa200\sl276\slmult1 \widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 }\noqfpromote {\stylesheet{\ql \li0\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af31507\afs22\alang1025 \ltrch\fcs0 \fs22\lang1033\langfe1042\loch\f31506\hich\af31506\dbch\af31505\cgrid\langnp1033\langfenp1042 \snext0 \sqformat \spriority0 \styrsid1847526 Normal;}{\*\cs10 \additive \ssemihidden \sunhideused \spriority1 Default Paragraph Font;}{\* \ts11\tsrowd\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\trcbpat1\trcfpat1\tblind0\tblindtype3\tscellwidthfts0\tsvertalt\tsbrdrt\tsbrdrl\tsbrdrb\tsbrdrr\tsbrdrdgl\tsbrdrdgr\tsbrdrh\tsbrdrv \ql \li0\ri0\sa200\sl276\slmult1 \widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs22\lang1033\langfe1042\loch\f31506\hich\af31506\dbch\af31505\cgrid\langnp1033\langfenp1042 \snext11 \ssemihidden \sunhideused \sqformat Normal Table;}{\s15\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af41\afs21\alang1025 \ltrch\fcs0 \fs21\lang1033\langfe1042\loch\f41\hich\af41\dbch\af31505\cgrid\langnp1033\langfenp1042 \sbasedon0 \snext15 \slink16 \sunhideused \styrsid5268979 Plain Text;}{\*\cs16 \additive \rtlch\fcs1 \af41\afs21 \ltrch\fcs0 \f41\fs21 \sbasedon10 \slink15 \slocked \styrsid5268979 Plain Text Char;}}{\*\rsidtbl \rsid1847526\rsid2183709\rsid5268979\rsid5733561\rsid11488848\rsid14178431\rsid14237745\rsid14313477\rsid14432744}{\mmathPr\mmathFont34\mbrkBin0\mbrkBinSub0\msmallFrac0\mdispDef1 \mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Messi}{\operator Messi}{\creatim\yr2017\mo5\dy11\hr13\min53}{\revtim\yr2017\mo5\dy11\hr14\min42}{\version4}{\edmins4}{\nofpages1}{\nofwords296}{\nofchars1385}{\nofcharsws1678} {\vern32775}}{\*\xmlnstbl {\xmlns1 http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect \widowctrl\ftnbj\aenddoc\trackmoves1\trackformatting1\donotembedsysfont1\relyonvml0\donotembedlingdata0\grfdocevents0\validatexml1\showplaceholdtext0\ignoremixedcontent0\saveinvalidxml0\showxmlerrors1\noxlattoyen \expshrtn\noultrlspc\dntblnsbdb\nospaceforul\formshade\horzdoc\dgmargin\dghspace180\dgvspace180\dghorigin1501\dgvorigin1701\dghshow1\dgvshow1 \jexpand\viewkind1\viewscale140\pgbrdrhead\pgbrdrfoot\splytwnine\ftnlytwnine\htmautsp\nolnhtadjtbl\useltbaln\alntblind\lytcalctblwd\lyttblrtgr\lnbrkrule\nobrkwrptbl\snaptogridincell\allowfieldendsel\wrppunct \asianbrkrule\rsidroot1847526\newtblstyruls\nogrowautofit\usenormstyforlist\noindnmbrts\felnbrelev\nocxsptable\indrlsweleven\noafcnsttbl\afelev\utinl\hwelev\spltpgpar\notcvasp\notbrkcnstfrctbl\notvatxbx\krnprsnet\cachedcolbal \nouicompat \fet0 {\*\wgrffmtfilter 2450}\nofeaturethrottle1\ilfomacatclnup0\ltrpar \sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sectrsid5268979\sftnbj {\*\pnseclvl1\pnucrm\pnstart1\pnindent720\pnhang {\pntxta \hich .}}{\*\pnseclvl2 \pnucltr\pnstart1\pnindent720\pnhang {\pntxta \hich .}}{\*\pnseclvl3\pndec\pnstart1\pnindent720\pnhang {\pntxta \hich .}}{\*\pnseclvl4\pnlcltr\pnstart1\pnindent720\pnhang {\pntxta \hich )}}{\*\pnseclvl5\pndec\pnstart1\pnindent720\pnhang {\pntxtb \hich (} {\pntxta \hich )}}{\*\pnseclvl6\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb \hich (}{\pntxta \hich )}}{\*\pnseclvl7\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb \hich (}{\pntxta \hich )}}{\*\pnseclvl8\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb \hich (} {\pntxta \hich )}}{\*\pnseclvl9\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb \hich (}{\pntxta \hich )}}\pard\plain \ltrpar\s15\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid5268979 \rtlch\fcs1 \af41\afs21\alang1025 \ltrch\fcs0 \fs21\lang1033\langfe1042\loch\af41\hich\af41\dbch\af31505\cgrid\langnp1033\langfenp1042 {\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 What Happened to My Computer? \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Y}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 our important files are encrypted. \par \hich\af31502\dbch\af53\loch\f31502 Many of your documents, photos, videos, databases and other files are no longer accessibl\hich\af31502\dbch\af53\loch\f31502 e because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption software. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Can I Recover My Files? \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 S}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 ure. We guarantee that you can recover all y\hich\af31502\dbch\af53\loch\f31502 our files safely and easily. But you have not so enough time. \par \hich\af31502\dbch\af53\loch\f31502 You can decrypt some of your files for free. \par \hich\af31502\dbch\af53\loch\f31502 But if you want to decrypt all your files, you need to pay. \par \hich\af31502\dbch\af53\loch\f31502 You only have 3 days to submit the payment. After that the\hich\af31502\dbch\af53\loch\f31502 price will be doubled. \par \hich\af31502\dbch\af53\loch\f31502 Also, if you don't pay in 7 days, you won't be able to recover your files forever. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 How Do I Pay? \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 P}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 ayment is accepted in Bitcoin only. For more i\hich\af31502\dbch\af53\loch\f31502 nformation, click <About bitcoin>. \par \hich\af31502\dbch\af53\loch\f31502 Please check the current price of Bitcoin and buy some bitcoins. For more information, click <How to buy bitcoins>. \par \hich\af31502\dbch\af53\loch\f31502 And send the correct amount to the address specified in this window. \par \hich\af31502\dbch\af53\loch\f31502 After your payment, contact us on discord: ballets4, we will give you the decryption software. \par \hich\af31502\dbch\af53\loch\f31502 Once the payment is checked, you can start decrypting your files immediately. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Contact \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Contact us on discord: ballets4 \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\cf6\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 We strongly recommend you to\hich\af31502\dbch\af53\loch\f31502 not remove this software, and disable your anti-virus for a while, until you pay and the payment gets processed. If your anti-virus gets updated and removes this software automatically, it will not be able to recover your files even if you pay!}{ \rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\cf6\loch\af31502\hich\af31502\dbch\af53\insrsid5268979\charrsid5733561 \par }{\*\themedata 504b030414000600080000002100828abc13fa0000001c020000130000005b436f6e74656e745f54797065735d2e786d6cac91cb6ac3301045f785fe83d0b6d8 72ba28a5d8cea249777d2cd20f18e4b12d6a8f843409c9df77ecb850ba082d74231062ce
URLs

http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect

Extracted

Path

C:\RlWCfyLxZ.README.txt

Ransom Note
======================================== !!! ATTENTION !!! Your Files Have Been Encrypted by ManiaCrypt ======================================== What Happened? -------------- All of your important files, documents, photos, and databases have been encrypted using RSA. Without our decryption program, your files cannot be restored. Why Trust Us: -------------------- If we dont give you the decryption program after payment, nobody will trust us. What You Need to Do: -------------------- To get the decryption program, you must contact us. Steps to Restore Your Files: ---------------------------- 1. Open Discord and add the username ballets4. 2. Send us a message and mention your situation. 3. We will provide further instructions for obtaining the decryption program. Important Information: ----------------------- - DO NOT attempt to recover your files using third-party tools. They may damage your data and make recovery impossible. - DO NOT rename, move, or modify the encrypted files. This will also make decryption impossible. - Only we have the tools required to decrypt your files safely and effectively. We are waiting for your message. Time is critical. ======================================== Your Files. Your Responsibility. ========================================

Targets

    • Target

      LoaderFuscate.exe

    • Size

      13.9MB

    • MD5

      c07637410f1d07d4fd69030fac313a7f

    • SHA1

      72a944ca04c28d7d651468b082ba1630900272e0

    • SHA256

      7880389d89e8e28cbf6ac18bfb40dc8661dec9d9723e97b14bea6f8dff91804b

    • SHA512

      747ebeceacf1342bee878ca9aa141b3939c309eee4c14dad3c9ab3f5a7affef45adff9ffc88c7e73368eb7fb3239a242845d4acbd3a3cf5ae94f403209d6393c

    • SSDEEP

      393216:pV2YFanmL01+l+uq+VvyUR9LrvF1+TtIiLCS9DNsIRfamd:XE601+l+uqgvyO9fd1QtIQ9iIdd

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Wannacry family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Renames multiple (624) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Download via BitsAdmin

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks