General

  • Target
    c7cf556fed330b8fbef1f25bdb6aec0007b42a042abfb4f82ba52e20754d0ee3.exe
  • Size 431KB
  • Sample260520-dqa4asas3m
  • SHA256 c7cf556fed330b8fbef1f25bdb6aec0007b42a042abfb4f82ba52e20754d0ee3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Path
  • C:\Users\Admin\Desktop\Important.txt

Ransom Note
  • DEAR USER.. This is the developer of DarkWorld File Crypter tool, you have been running our tool in your system which caused your files to get encrypted. Don't worry, you can return all your files! All your files like pictures, databases, documents and other important files that were encrypted with strongest encryption and unique key. The only method of recovering files is to purchase the Decryption tool from me. the decryption tool will not be able to decrypt your files if the encrypted files were encrypted after 72 hours , which means you need to contact us before 72hours from decryption so we can help you solve your problem. Please note that you'll never restore your data without payment. Price of private key and decrypt software is $300. To Buy the decryption tool you must follow the following steps : 1 - Send the equivalent of 300$ in bitcoins to this wallet : 1EdxGR5fxRjhWtxNSbyDHv4nVdx5BP54L2 ----------------------------------------------------- * What is bitcoin ? : https://www.investopedia.com/terms/b/bitcoin.asp * How to buy Bitcoin ? : https://www.investopedia.com/articles/investing/082914/basics-buying-and-investing-bitcoin.asp * Where to buy Bitcoin ? : https://www.blockchain.com/ https://coinbase.com/ https://robinhood.com/ https://www.coinmama.com ----------------------------------------------------- 2 - Once your payment is done copy your personal ID and send it to me in this email : << [email protected] >>. ----------------------------------------------------- 3 - After i confirm the payment is received you will immediatly receive the decryption tool and the decryption key of your files , and also you will receive a full guide and a video explaining how to use the decryption tool to decrypt all your files . ----------------------------------------------------- 4 - in case of trust issues you can send one of your encrypted files to my email and i will decrypt it and send it back to you as a valid proof of the decryption tool. Your personal ID : 24564449
Wallets
  • 1EdxGR5fxRjhWtxNSbyDHv4nVdx5BP54L2

URLs
  • https://www.investopedia.com/terms/b/bitcoin.asp

  • https://www.investopedia.com/articles/investing/082914/basics-buying-and-investing-bitcoin.asp

  • https://www.blockchain.com/

  • https://coinbase.com/

  • https://robinhood.com/

  • https://www.coinmama.com

Extracted

Path
  • C:\Users\Admin\Desktop\Important.txt

Ransom Note
  • DEAR USER.. This is the developer of DarkWorld File Crypter tool, you have been running our tool in your system which caused your files to get encrypted. Don't worry, you can return all your files! All your files like pictures, databases, documents and other important files that were encrypted with strongest encryption and unique key. The only method of recovering files is to purchase the Decryption tool from me. the decryption tool will not be able to decrypt your files if the encrypted files were encrypted after 72 hours , which means you need to contact us before 72hours from decryption so we can help you solve your problem. Please note that you'll never restore your data without payment. Price of private key and decrypt software is $300. To Buy the decryption tool you must follow the following steps : 1 - Send the equivalent of 300$ in bitcoins to this wallet : 1EdxGR5fxRjhWtxNSbyDHv4nVdx5BP54L2 ----------------------------------------------------- * What is bitcoin ? : https://www.investopedia.com/terms/b/bitcoin.asp * How to buy Bitcoin ? : https://www.investopedia.com/articles/investing/082914/basics-buying-and-investing-bitcoin.asp * Where to buy Bitcoin ? : https://www.blockchain.com/ https://coinbase.com/ https://robinhood.com/ https://www.coinmama.com ----------------------------------------------------- 2 - Once your payment is done copy your personal ID and send it to me in this email : << [email protected] >>. ----------------------------------------------------- 3 - After i confirm the payment is received you will immediatly receive the decryption tool and the decryption key of your files , and also you will receive a full guide and a video explaining how to use the decryption tool to decrypt all your files . ----------------------------------------------------- 4 - in case of trust issues you can send one of your encrypted files to my email and i will decrypt it and send it back to you as a valid proof of the decryption tool. Your personal ID : 60114754
Wallets
  • 1EdxGR5fxRjhWtxNSbyDHv4nVdx5BP54L2

URLs
  • https://www.investopedia.com/terms/b/bitcoin.asp

  • https://www.investopedia.com/articles/investing/082914/basics-buying-and-investing-bitcoin.asp

  • https://www.blockchain.com/

  • https://coinbase.com/

  • https://robinhood.com/

  • https://www.coinmama.com

Targets

    • Target
      c7cf556fed330b8fbef1f25bdb6aec0007b42a042abfb4f82ba52e20754d0ee3.exe
    • Size 431KB
    • SHA256 c7cf556fed330b8fbef1f25bdb6aec0007b42a042abfb4f82ba52e20754d0ee3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10

MITRE ATT&CK Matrix

Tasks