General
- Target e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b.bin.exe
- Size 12.1MB
- Sample260313-vxtbwsey4v
- SHA256 e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\UNLOCK_MY_FILES.txt
-
blacksnake
Ransom Note
- Your important files are encrypted. If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service. We guarantee that you can recover all your files safely and easily. All you need to do is submit the payment and purchase the decryption software. Please follow the instructions: 1. Send $20 USD worth of Bitcoin to following address: bc1qu7f2m5r7al0fmank5mkq0xju3z3rkdvj778v45 2. Send the transaction ID to [email protected] with the subject 'TX ID' (In case of no response in 24 hours contact us via the email addresses listed bellow) 3. The decryption software will be sent to you within 48 hours. OUR ALT EMAIL ADDRESSES: [email protected] [email protected] [email protected] [email protected] Please note that it may take longer for us to respond if the demand of our services is high, we'll try to contact you as soon as possible, just be patient please. If our email addresses get suspended we will provide updated information in the following site so we can stay in contact with our clients. http://torpastezr7464pevuvdjisbvaf4yqi4n7sgz7lkwgqwxznwy5duj4ad.onion/raw/t8st1gRNbg6ea2D7UQJq/ IMPORTANT: YOU NEED TO INSTALL TOR BROWSER IN ORDER TO VISIT .ONION SITES DOWNLOAD IT USING THE FOLLOWING LINK: https://torproject.org - FAQ - There isn't another way to unlock my files? No, the content of your files is encrypted using AES-256 and RSA-2048 cryptographic combination, nobody can unlock your files without the private key, please avoid using third-party software to decrypt your files, only us have the private key and we are the only who can recover your files. How can i be sure that, if i pay, i won't be scammed? We really care about our reputation, and to prove we can help you decrypt your files, you can send us ONE of your encrypted files (NOT BIGGER THAN 5 MB, WE ARE NOT RESPONSIBLE IF THE FILE CONTAINS ANY PERSONAL INFORMATION) and we will decrypt it for free. How can i get Bitcoins and what is a Bitcoin transaction ID? Do some research, there is plenty of information about this on the internet. If you can't find the answer to your question then contact us to the email address bellow, we'll prioritize clients who are having ACTUAL ISSUES submitting the payment. [email protected] - IF YOU HAVE QUESTIONS SEND THEM TO THIS EMAIL, WE WILL IGNORE QUESTIONS SENT TO ANY OTHER EMAIL ADDRESS. WARNING: DO NOT TRY TO DECRYPT MANUALLY OR USING THIRD-PARTY SOFTWARE, YOU CAN CORRUPT YOUR FILES AND THEREFORE NOT EVEN US WILL BE ABLE TO DECRYPT THEM.
Emails
URLs
-
http://torpastezr7464pevuvdjisbvaf4yqi4n7sgz7lkwgqwxznwy5duj4ad.onion/raw/t8st1gRNbg6ea2D7UQJq/
Targets
-
- Target e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b.bin.exe
- Size 12.1MB
- SHA256 e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b
Score10/10-
BlackSnake
BlackSnake is a Windows ransomware.
-
Blacksnake family
-
Renames multiple (399) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry