General
- Target 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328
- Size 612KB
- Sample260604-stbxbsas4q
- SHA256 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328
Score
10/10
Malware Config
Extracted
Path
-
C:\#HowToRecover.txt
Ransom Note
- Your Files Have Been Encrypted! Attention! All your important files have been stolen and encrypted by our advanced attack. Without our special decryption software, theres no way to recover your data! Your ID: [ E8330FE1-1337 ] To restore your files, reach out to us at: [email protected] You can also contact us via Telegram: @Hedaransom Failing to act may result in sensitive company data being leaked or sold. Do NOT use third-party tools, as they may permanently damage your files. Why Trust Us? Before making any payment, you can send us few files for free decryption test. Our business relies on fulfilling our promises. How to Buy Bitcoin? You can purchase Bitcoin to pay the ransom using these trusted platforms: https://www.kraken.com/learn/buy-bitcoin-btc https://www.coinbase.com/en-gb/how-to-buy/bitcoin https://paxful.com
Emails
URLs
-
https://paxful.com
Targets
-
- Target 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328
- Size 612KB
- SHA256 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328
Score10/10-
Renames multiple (7425) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry