General
- Target vile.exe
- Size 9.0MB
- Sample260427-ejc5raes7r
- SHA256 da8d89a25d0edc6186a9e70bca59e37a25b1f4ab84966ed1e4b9aa35d2c20601
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\VILE_README.txt
Ransom Note
- ===================================================================== YOUR FILES HAVE BEEN ENCRYPTED ===================================================================== Oooops! your computer is now under the control of the vile collective. All data has been encrypted using an unbreakable offshore servers, your files are permanently inaccessible. ===================================================================== ENCRYPTION SUMMARY ===================================================================== Files encrypted: 827 Total size: 180.71 MB Victim ID: 4da5ce86d03f5f88555a32d2ddca5172 Time: 2026-04-27 04:58:03 ===================================================================== WHAT HAPPENED? ===================================================================== All your files are have been encrypted with military-grade encryption. The encryption key has been sent to our secure server. Without it, your files cannot be recovered. Backups have been destroyed. Recovery tools have been disabled. ===================================================================== HOW TO RECOVER YOUR FILES ===================================================================== 1. Contact us using the information below 2. Provide your Victim ID 3. Wait for further instructions ===================================================================== PAYMENT ===================================================================== Amount: $1,500 USD BTC: bc1q9mgz97m0j4vtutjqq966vmj785tsr38nvafwxm XMR: 4AQ9VGowYXNdowUeSCGFLFV7inyRuRRfxBQQSDurBsSi8j7FJNANJY917P1CmvE8cFbVJ5Gx99rYX7SoSjDQkzbH34P8Xf4 ===================================================================== DEADLINE ===================================================================== Public data publication will happen after 7 days You will lose your files will happen after 14 days ===================================================================== CONTACT ===================================================================== ===================================================================== WARNINGS ===================================================================== DO NOT: Attempt to decrypt files yourself Rename or modify encrypted files Use third-party recovery tools Run system restore Reinstall Windows Any attempt to modify, recover, or remove this application will result in the PERMANENT DESTRUCTION of your decryption key If you do not cooperate before the deadline, your files will remain locked and your private data will be published for everyone to see. Do not turn off, restart, or unplug this computer — doing so may permanently damage your files. If you attempt to power down, the decryption key will be destroyed. =====================================================================
Targets
-
- Target vile.exe
- Size 9.0MB
- SHA256 da8d89a25d0edc6186a9e70bca59e37a25b1f4ab84966ed1e4b9aa35d2c20601
Score10/10-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Sets desktop wallpaper using registry