Overview

overview

10

Static

static

3

vile.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    vile.exe
  • Size 8.7MB
  • Sample260427-b5fafsa181
  • SHA256 f376376336cdeb0dbd1bdd3e9684a837f907ec863d2a859097e46d4a5e6f1f42
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\VILE_README.txt

Ransom Note
  • ===================================================================== YOUR FILES HAVE BEEN ENCRYPTED ===================================================================== Oooops! your computer is now under the control of the vile collective. All data has been encrypted using an unbreakable offshore servers, your files are permanently inaccessible. ===================================================================== ENCRYPTION SUMMARY ===================================================================== File encrypted: 1523 Total size: 308.27 MB Victim ID: b00acdac030aea7fc3884bd9fa28d651 Time: 2026-04-27 02:43:36 ===================================================================== WHAT HAPPENED? ===================================================================== All your files are have been encrypted with military-grade encryption. The encryption key has been sent to our secure server. Without it, your files cannot be recovered. Backups have been destroyed. Recovery tools have been disabled. ===================================================================== HOW TO RECOVER YOUR FILES ===================================================================== 1. Contact us using the information below 2. Provide your Victim ID 3. Wait for further instructions ===================================================================== PAYMENT ===================================================================== Amount: $1,500 USD BTC: bc1q9mgz97m0j4vtutjqq966vmj785tsr38nvafwxm XMR: 4AQ9VGowYXNdowUeSCGFLFV7inyRuRRfxBQQSDurBsSi8j7FJNANJY917P1CmvE8cFbVJ5Gx99rYX7SoSjDQkzbH34P8Xf4 ===================================================================== DEADLINE ===================================================================== Public data publication will happen after 14 days ===================================================================== CONTACT ===================================================================== ===================================================================== WARNINGS ===================================================================== DO NOT: Attempt to decrypt files yourself Rename or modify encrypted files Use third-party recovery tools Run system restore Reinstall Windows Any attempt to modify, recover, or remove this application will result in the PERMANENT DESTRUCTION of your decryption key If you do not cooperate before the deadline, your files will remain locked and your private data will be published for everyone to see. Do not turn off, restart, or unplug this computer — doing so may permanently damage your files. If you attempt to power down, the decryption key will be destroyed. =====================================================================

Extracted

Path

  • C:\Users\Admin\Desktop\VILE_README.txt

Ransom Note
  • ===================================================================== YOUR FILES HAVE BEEN ENCRYPTED ===================================================================== Oooops! your computer is now under the control of the vile collective. All data has been encrypted using an unbreakable offshore servers, your files are permanently inaccessible. ===================================================================== ENCRYPTION SUMMARY ===================================================================== File encrypted: 6 Total size: 1.01 MB Victim ID: d1b0d669f1cb6153189d76b3cabac331 Time: 2026-04-27 02:44:17 ===================================================================== WHAT HAPPENED? ===================================================================== All your files are have been encrypted with military-grade encryption. The encryption key has been sent to our secure server. Without it, your files cannot be recovered. Backups have been destroyed. Recovery tools have been disabled. ===================================================================== HOW TO RECOVER YOUR FILES ===================================================================== 1. Contact us using the information below 2. Provide your Victim ID 3. Wait for further instructions ===================================================================== PAYMENT ===================================================================== Amount: $1,500 USD BTC: bc1q9mgz97m0j4vtutjqq966vmj785tsr38nvafwxm XMR: 4AQ9VGowYXNdowUeSCGFLFV7inyRuRRfxBQQSDurBsSi8j7FJNANJY917P1CmvE8cFbVJ5Gx99rYX7SoSjDQkzbH34P8Xf4 ===================================================================== DEADLINE ===================================================================== Public data publication will happen after 14 days ===================================================================== CONTACT ===================================================================== ===================================================================== WARNINGS ===================================================================== DO NOT: Attempt to decrypt files yourself Rename or modify encrypted files Use third-party recovery tools Run system restore Reinstall Windows Any attempt to modify, recover, or remove this application will result in the PERMANENT DESTRUCTION of your decryption key If you do not cooperate before the deadline, your files will remain locked and your private data will be published for everyone to see. Do not turn off, restart, or unplug this computer — doing so may permanently damage your files. If you attempt to power down, the decryption key will be destroyed. =====================================================================

Targets

    • Target
      vile.exe
    • Size 8.7MB
    • SHA256 f376376336cdeb0dbd1bdd3e9684a837f907ec863d2a859097e46d4a5e6f1f42
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionransomwarespywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks