General
- Target 65f77a21080cb4f151d0df6142a0eb039f6ecdc73346e7eece0f56408b8f4c27.zip
- Size 398KB
- Sample260620-1eba9ahy3n
- SHA256 ce4ddfbcc5ac59f199a0c27b5657e4d4a7fa3df2abee7eeb3840b64a2cf5edec
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT
Ransom Note
- Ooops, your important files are encrypted. If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service. We guarantee that you can recover all your files safely and easily. All you need to do is submit the payment and purchase the decryption key. Please follow the instructions: 1. Send $1000 worth of Bitcoin to following address: 34UNkKSGZZvf5AYbjkUa2yYYzw89ZLWxu2 2. Send your Bitcoin wallet ID and personal installation key to e-mail [email protected]. Your personal installation key: qVedT1PUM8jBE4Toe3saXuMvP54a9cmpVrcHCRomwPMAf2VSaxz59Rymo3YP4bDTiBJFkGJayca2vh4ZNmwHVmmadmmisPDM
Emails
Wallets
-
34UNkKSGZZvf5AYbjkUa2yYYzw89ZLWxu2
Extracted
Path
-
C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT
Ransom Note
- Ooops, your important files are encrypted. If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service. We guarantee that you can recover all your files safely and easily. All you need to do is submit the payment and purchase the decryption key. Please follow the instructions: 1. Send $1000 worth of Bitcoin to following address: 34UNkKSGZZvf5AYbjkUa2yYYzw89ZLWxu2 2. Send your Bitcoin wallet ID and personal installation key to e-mail [email protected]. Your personal installation key: scf1vTGCDeoMfWYydbU96fu5dpK4fpoDpKn81AbrDoXuLCDhoL86gcxVpL7roZf7ozsi5f8z3bTshPR4zYMMS4xav5QVBeMW
Emails
Wallets
-
34UNkKSGZZvf5AYbjkUa2yYYzw89ZLWxu2
Targets
-
- Target 65f77a21080cb4f151d0df6142a0eb039f6ecdc73346e7eece0f56408b8f4c27.exe
- Size 422KB
- SHA256 65f77a21080cb4f151d0df6142a0eb039f6ecdc73346e7eece0f56408b8f4c27
Score10/10-
Renames multiple (1260) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.