51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2

General

Target
51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2.exe
Size 14.2MB
Sample250917-l9x16sysbv
SHA256 51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2
MD5 adf675ffc1acb357f2d9f1a94e016f52
SHA1 2cd15d5d4cc58d06cfb6be5eabc681925d0ce5ce
SHA512 595728b9cda47b59abcb9145da8f3101223d87dbd3d372db4688afd236b81a611cefa2cf268ce22b5a968a2bd118f83a505673c041aca558cec2bb5f0abcea44
SSDEEP 196608:0aXETABIUswT55RNYi9t4M/ovDL8j7askQSrR2vPJzsb20RQbJxF9:0oBI6vRyihUY7atHYvPZZR9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

F:\README-GENTLEMEN.txt

Ransom Note

3b7b4f2d33bdfb8a31b480d0eb2815cd = YOUR ID Your network has been encrypted. All encrypted files now have a new extension. 1) If you modify or rename encrypted files, our decryption software will NOT be able to restore them. 2) If you use any third-party recovery software, you may permanently damage your files (see item 1). 3) You need our unique decryption key and our software to restore your data. Your files cannot be decrypted without our key, not even with a quantum computer (that’s about 2^256 possible combinations — more than the number of atoms in the universe). Any attempts to brute-force or dump RAM will not help (locker binaries not contain the private key). Only we have the required key. Don’t try to. You will lose. This is not just a limitation of today’s technology - it’s a fundamental mathematical reality. 4) Law enforcement, authorities, or data recovery companies will NOT be able to help you. Most of them will only take your money and waste your time. They will prevent you from paying the ransom, but will NOT recover your files. As a result, your business will be lost. 5) Please note that attempts to restore the system may ultimately lead to a complete wipe of the system. We have also downloaded sensitive/confidential data from your network, including NAS storage, Acronis cloud, etc. If you do not contact us, or refuse to cooperate, your data will be published on our blog leak site and other hack forums, blogs, and social networks (X, Reddit, Facebook, etc). BLOG link: http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/ Download Tor Browser: https://www.torproject.org/download/ TOX CONTACT - RECOVER YOUR FILES Download TOX messenger: https://tox.chat/download.html Contact us (add via TOX ID): F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E Any other means of communication are fake and may be set up by third parties. Only use the methods listed in this note or on the specified website.

URLs

http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/
https://tox.chat/download.html

Targets

- Target
  51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2.exe
- Size 14.2MB
- SHA256 51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2
- MD5 adf675ffc1acb357f2d9f1a94e016f52
- SHA1 2cd15d5d4cc58d06cfb6be5eabc681925d0ce5ce
- SHA512 595728b9cda47b59abcb9145da8f3101223d87dbd3d372db4688afd236b81a611cefa2cf268ce22b5a968a2bd118f83a505673c041aca558cec2bb5f0abcea44
- SSDEEP 196608:0aXETABIUswT55RNYi9t4M/ovDL8j7askQSrR2vPJzsb20RQbJxF9:0oBI6vRyihUY7atHYvPZZR9
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion discovery execution impact ransomware
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (135) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1