General
- Target JaffaCakes118_38e37cf8e2d5c41a849ef6c41f183dc3
- Size 50KB
- Sample251218-zv36jaykhw
- SHA256 d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\LegionReadMe.txt
Ransom Note
- Ooops! All your important files are encrypted! What happend to my computer? All your important files are encrypted. No one can help you to restore files without our special decryptor Backups were either encrypted or deleted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is below) and attach 2-3 encrypted files. You will receive decrypted samples. To decrypt other files you have to pay $50. How do i pay? Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some Bitcoins. And send the correct amount to the address specified at the bottom of the sheet. Contact: 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us ([email protected]) In case of no anwser in 72 hours write us to this email: [email protected] What if i already paid? Send your Bitcoin wallet ID to e-mail provided above. Attention! 1.Do not modify encrypted files. 2.Do not try decrypt your data using third party software, it may cause pernament data loss. Our Bitcoin address: 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh
Wallets
-
131fjhrB4wH8j6adZXudp1Wn23pR33tpAh
URLs
-
http://mail2tor2zyjdctd.onion/
Targets
-
- Target JaffaCakes118_38e37cf8e2d5c41a849ef6c41f183dc3
- Size 50KB
- SHA256 d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5
Score10/10-
Modifies WinLogon for persistence
-
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Sets desktop wallpaper using registry