General
- Target 65f77a21080cb4f151d0df6142a0eb039f6ecdc73346e7eece0f56408b8f4c27.zip
- Size 398KB
- Sample260620-1vvd3aay6t
- SHA256 cce1b724f48bd2509a11fe4e6a4de263f6d4d97ca5fe340132845827896a4548
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT
Ransom Note
- Ooops, your important files are encrypted. If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service. We guarantee that you can recover all your files safely and easily. All you need to do is submit the payment and purchase the decryption key. Please follow the instructions: 1. Send $1000 worth of Bitcoin to following address: 34UNkKSGZZvf5AYbjkUa2yYYzw89ZLWxu2 2. Send your Bitcoin wallet ID and personal installation key to e-mail [email protected]. Your personal installation key: nHHREKX47MeK5evbZExZT59coKuJdziWRJ36ksShgrye7xR7g18zQyT9siPwkxf2WFGfsLy6WDa9BSjhJ8t8sutBjjQuLHMm
Emails
Wallets
-
34UNkKSGZZvf5AYbjkUa2yYYzw89ZLWxu2
Extracted
Path
-
C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT
Ransom Note
- Ooops, your important files are encrypted. If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service. We guarantee that you can recover all your files safely and easily. All you need to do is submit the payment and purchase the decryption key. Please follow the instructions: 1. Send $1000 worth of Bitcoin to following address: 34UNkKSGZZvf5AYbjkUa2yYYzw89ZLWxu2 2. Send your Bitcoin wallet ID and personal installation key to e-mail [email protected]. Your personal installation key: qAs18kUAhbsudMiiNZ5RiNXebDYyyTN8MZ93wUnTgjfkf1gkm8JgHkGevtrWGhbBMZM3c3RYzZxF7tqwZhj4rZtyhnSrM4M6
Emails
Wallets
-
34UNkKSGZZvf5AYbjkUa2yYYzw89ZLWxu2
Targets
-
- Target 65f77a21080cb4f151d0df6142a0eb039f6ecdc73346e7eece0f56408b8f4c27.exe
- Size 422KB
- SHA256 65f77a21080cb4f151d0df6142a0eb039f6ecdc73346e7eece0f56408b8f4c27
Score10/10Renames multiple (1264) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.