ouroboros | d83723f572e06c97ba7b1d51ca8c63b95d633cef13c426abdb2d4782b36ab339

General

Target

HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.7z
Size

1.3MB
Sample

250315-vwer4ssnz2
MD5

98e7aa73bc953854d53454484e26ca0c
SHA1

2e842b7293158af9b62c8a8f8200ac2113a57601
SHA256

d83723f572e06c97ba7b1d51ca8c63b95d633cef13c426abdb2d4782b36ab339
SHA512

7c62887161b8921c14c928b1ccad3a76d785c827b45143e708d50fe74e6bbe0bf01f3ac162a3261b3272f1bd9c5a4ae8adb0b50e8877a61e4601aa123efbb958
SSDEEP

24576:FkGHJ+rZRWGcmOoyOk7fhQQfugQbhtTynAJXCvPBBLGwCv2mIJOHc03uKKYCtLqV:FtHJAQvmryZ7fhlabyLnBBLiv2mIJ8c4

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Decrypt-info.txt

Ransom Note

All your files are encrypted due to security problem with your computer. You should pay money to recover your files. The price depends on how fast do you message us. You should contact us via this email address: [email protected] if you didn't receive any reply, message our second email address: [email protected] We guarantee that if you make payment, all your files will be recovered. You can send few example files. We recover them for you to prove that we can recover your files. Attention: Do not rename encrypted files. Do not try to decrypt your data using third-party software, it may cause permanent data loss. The decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.) Attach "C:\ProgramData\prvkey1.txt.key" file with your email. Do not delete this file, it causes permanent data loss.

Emails

[email protected]

Targets

- Target
  
  HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.exe
- Size
  
  1.3MB
- MD5
  
  b5fcddeec6422bec63cbd59d4d0aaeab
- SHA1
  
  2fb1cbec471ba7f0859e2a804e4cd51fb6b0be54
- SHA256
  
  150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc
- SHA512
  
  825706455bcfcbfe9186f9030229f8d6aa64555803ff2f0ff8723f05b50511e9d889e4a8ebc2bbffff573930b07fe6b41b577d43262490032646d01d47918c55
- SSDEEP
  
  24576:XN4EfsPHd9VbyiKSnKMnsNneRWrN2jHwTxbMmgCyq3eca44zpRPtHS:9z0/0iKSnKYsNn4WZ2LwQNGeca4aPl
Score

10^/10

ouroboros credential_access defense_evasion discovery persistence privilege_escalation ransomware spyware stealer upx
- Ouroboros family
  ouroboros
- Ouroboros/Zeropadypt
  Ransomware family based on open-source CryptoWire.
  ransomware ouroboros
- Renames multiple (651) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2