zarok | a3f884dfa336e6524e4870154c3ab8217e5f34fa6baae5281e3d36b179b8a83d

General

Target
a3f884dfa336e6524e4870154c3ab8217e5f34fa6baae5281e3d36b179b8a83d.bin
Size 178KB
Sample251121-mgr5wseq5s
SHA256 a3f884dfa336e6524e4870154c3ab8217e5f34fa6baae5281e3d36b179b8a83d
MD5 4ac4612b9d02c1fae1c5d8a90191af4e
SHA1 df02be86dfeb0368408ab9d0e53c387566108dda
SHA512 209b29d315544377655e9e1c4b57e4c3987053f53a004745dc0089e45b6e6a9bb10e72a2249603e224d6adeebbae2d7e3b7ef32d32aada148b7a208fafba60db
SSDEEP 3072:HogJbyn9QlDvHpodFBTsSH5iQV8AhTFHFepVoKzFaz8VrN5FyMCfeCaFigVh:db0UGESHgpVw8NCwFiu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\3D Objects\README_NOW_ZAROK.txt

zarok

Ransom Note

Greeting, We are Zarok Ransomware group. We have infected your computer... How to recover your files and your privacy without any leaks or problems? 1. Buy Bitcoin How to buy Bitcoin? Go on 'Exodus wallet' or others wallet. Buy 200 EUR in BTC (Bitcoin) 2. Pay How to pay? First thing you go on your wallet. Go on pay or something like that and select the adress to receive. Our adress: bc1qe4ccx4tdm0acl7809et4u5jk8z78x7gwj3zmx5 Just pay and sent us on Telegram: @stfuhq the proof. 3. After the payment + verification You will receive a ransomware decrypter. We delete all your data and others shit without any problems. You will recover all of your stuff just wait for it. 4. If u don't pay? First all of your data are leaked on the web (ALL). You will lost every fucking files and folders do you have. - Zarok Ransomware.

Targets

- Target
  a3f884dfa336e6524e4870154c3ab8217e5f34fa6baae5281e3d36b179b8a83d.bin
- Size 178KB
- SHA256 a3f884dfa336e6524e4870154c3ab8217e5f34fa6baae5281e3d36b179b8a83d
- MD5 4ac4612b9d02c1fae1c5d8a90191af4e
- SHA1 df02be86dfeb0368408ab9d0e53c387566108dda
- SHA512 209b29d315544377655e9e1c4b57e4c3987053f53a004745dc0089e45b6e6a9bb10e72a2249603e224d6adeebbae2d7e3b7ef32d32aada148b7a208fafba60db
- SSDEEP 3072:HogJbyn9QlDvHpodFBTsSH5iQV8AhTFHFepVoKzFaz8VrN5FyMCfeCaFigVh:db0UGESHgpVw8NCwFiu
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion evasion execution zarok impact persistence ransomware spyware stealer
- Zarok Ransomware
  Zarok is a ransomware, appending a random four-character extension.
  ransomware zarok
- Zarok family
  zarok
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2