cloak | 8fbfc27d2affd969d165d8eeb25b83aac6e5fd8e4624b3a3800c0bbd77c0f1ae

General

Target
A3R6C9.exe
Size 180KB
Sample260615-mnb29acy2q
SHA256 8fbfc27d2affd969d165d8eeb25b83aac6e5fd8e4624b3a3800c0bbd77c0f1ae
MD5 893a39c34bce96b1ed5fef89533d52c0
SHA1 5315f170d19f234a30d5b30e3f2d0719c6be4866
SHA512 9a1c202db751e5713551a9afbaf321f4880e94fc0a0584e0c6786f5423faaab82fbbb2d0ff4eaa83f23d22d172699e8cf62b77049d3dbd31b48e81819aa3a083
SSDEEP 3072:8B/5U7rXgNoku2TspaCNbH5Xj3pFoap9IzxxSybrTP/4dgovM7nsoCYDr3Vout:8R5U7rwN02Ty3jXoaoxS04dLMzN73VoS
TLSH
T17C0412ABD4A9D85FF08F1BB501D658BD1E880B6440B8B57894EF7DE2C0FA71A7910E70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\readme_for_unlock.txt

Ransom Note

ATTENTION! Your network is hacked and files are encrypted. Including the encrypted data we also downloaded other confidential information: Data of your employees, customers, partners, as well as accounting and other internal documentation of your company. All data is stored until you will pay. After payment we will provide you the programs for decryption and we will delete your data. If you refuse to negotiate with us (for any reason) all your data will be put up for sale. What you will face if your data gets on the black market: 1) The personal information of your employees and customers may be used to obtain a loan or purchases in online stores. 2) You may be sued by clients of your company for leaking information that was confidential. 3) After other hackers obtain personal data about your employees, social engineering will be applied to your company and subsequent attacks will only intensify. 4) Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. 5) You will forever lose the reputation. 6) You will be subject to huge fines from the government. You can learn more about liability for data loss here: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr-info.eu/ Courts, fines and the inability to use important files will lead you to huge losses. The consequences of this will be irreversible for you. Contacting the police will not save you from these consequences, but will only make your situation worse. You can get out of this situation with minimal losses To do this you must strictly observe the following rules: DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files. Such actions may DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it may also DAMAGE files. DO NOT Shutdown or Reboot the system this may DAMAGE files. DO NOT hire any third party negotiators (recovery/police, etc.) You need to contact us as soon as possible and start negotiations. Instructions for contacting our team: Download & Install TOR browser: https://torproject.org For contact us via LIVE CHAT open our >Website: http://ae4d4tbc4sbwtvse7pgexoogttfhk2hk47efz4d3qddg4yhxd4t5c7ad.onion >Login: customer >Password: L&i++dcsMHXnIcPdXir+L&Czb4OnsN >Secret: UYYm@6NuSEm3psu9TGyq If Tor is restricted in your area, use VPN��

URLs

https://gdpr-info.eu/
http://ae4d4tbc4sbwtvse7pgexoogttfhk2hk47efz4d3qddg4yhxd4t5c7ad.onion

Targets

- Target
  A3R6C9.exe
- Size 180KB
- SHA256 8fbfc27d2affd969d165d8eeb25b83aac6e5fd8e4624b3a3800c0bbd77c0f1ae
- MD5 893a39c34bce96b1ed5fef89533d52c0
- SHA1 5315f170d19f234a30d5b30e3f2d0719c6be4866
- SHA512 9a1c202db751e5713551a9afbaf321f4880e94fc0a0584e0c6786f5423faaab82fbbb2d0ff4eaa83f23d22d172699e8cf62b77049d3dbd31b48e81819aa3a083
- SSDEEP 3072:8B/5U7rXgNoku2TspaCNbH5Xj3pFoap9IzxxSybrTP/4dgovM7nsoCYDr3Vout:8R5U7rwN02Ty3jXoaoxS04dLMzN73VoS
- TLSH
  T17C0412ABD4A9D85FF08F1BB501D658BD1E880B6440B8B57894EF7DE2C0FA71A7910E70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution cloak impact persistence privilege_escalation ransomware spyware stealer upx
- Family: Cloak
  Cloak is a ransomware that has been active since 2022.
  ransomware cloak
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (10132) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2