General
- Target 10700ee5caad40e74809921e11b7e3f2330521266c822ca4d21e14b22ef08e1d.exe
- Size 2.6MB
- Sample260430-xdz2facz5k
- SHA256 10700ee5caad40e74809921e11b7e3f2330521266c822ca4d21e14b22ef08e1d
Score
10/10
Malware Config
Extracted
Path
-
C:\Recovery\_README_Yurei.txt
-
yurei
Ransom Note
- --== Yurei ==-- Dear Management, If you are reading this message, it means that: ├─ Your company’s internal infrastructure has been fully or partially compromised. ├─ All your backups — both virtual and physical — and everything we could access have been completely wiped. └─ Additionally, we have exfiltrated a large amount of your corporate data prior to encryption. We fully understand the damage caused by locking your internal resources. Now, let’s set emotions aside and try to build a constructive dialogue. WHAT YOU NEED TO KNOW ├─ Dealing with us will save you a lot — we have no interest in financially destroying you. ├─ We will thoroughly analyze your finances, bank statements, income, savings, and investments, and present a reasonable demand. ├─ If you have active cyber insurance, let us know — we will guide you on how to properly use it. └─ Dragging out negotiations will only cause the deal to fail. PAYMENT BENEFITS ├─ Paying us saves time, money, and effort — you can be back on track within approximately 24 hours. ├─ Our decryptor works perfectly on all files and systems — you can request a test decryption at any time. └─ Attempting recovery on your own may result in permanent file loss or corruption — in such cases, we won’t be able to help. SECURITY REPORT & EXCLUSIVE INFO ├─ The report and first-hand insights we provide upon agreement are invaluable. └─ No full network audit will reveal the specific vulnerabilities we exploited to access your data and infrastructure. WHAT HAPPENED ├─ Your network infrastructure has been compromised. ├─ Critical data has been exfiltrated. └─ Files have been encrypted. WHAT YOU SHOULD NOT DO ├─ Do NOT rename, modify, or delete encrypted files. ├─ Do NOT shut down your system or run antivirus software — this may cause irreversible damage. └─ Do NOT waste time with data recovery companies — they cannot help you. VALUABLE DATA WE USUALLY STEAL ├─ Databases, legal documents, and personal information ├─ Audit reports, SQL databases ├─ Financial documents: statements, invoices, accounting data ├─ Work files and corporate communications ├─ Any backup solutions └─ Confidential documents TO DO LIST (Best Practices) ├─ Contact us as soon as possible via our live chat (only). ├─ Purchase our decryption tool — there is no other way to recover your data. ├─ Avoid third-party negotiators or recovery services. └─ Do not attempt to use public decryption tools — you risk permanent data loss. RESPONSIBILITY ├─ Violating the terms of this offer will result in: │ - Deletion of your decryption keys │ - Immediate sale or public disclosure of your leaked data │ - Notification of regulatory agencies, competitors, and clients --- **CHAT:** Yurei CHAT: Your Ticket ID: Blog: --- Thank you for your attention. --- **Important Notes:** - Renaming, copying, or moving encrypted files may break the cipher and make decryption impossible. - Using third-party recovery tools can irreversibly damage encrypted files. - Shutting down or restarting the system may cause boot or recovery errors and further damage the encrypted data.
Targets
-
- Target 10700ee5caad40e74809921e11b7e3f2330521266c822ca4d21e14b22ef08e1d.exe
- Size 2.6MB
- SHA256 10700ee5caad40e74809921e11b7e3f2330521266c822ca4d21e14b22ef08e1d
Score10/10-
Family: Yurei
Yurei is a Golang based ransomware family derived from PrincessLocker.
-
Renames multiple (191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Sets desktop wallpaper using registry