General
- Target FakeCry.exe
- Size 36.7MB
- Sample260705-h19f3aew2n
- SHA256 9e77b5b8439fe908dcfb088fd9e11beaabc21fb0c01dab40e14acada9a0e0086
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Downloads\READ_ME_FAKECRY.txt
Ransom Note
- YOUR FILES HAVE BEEN ENCRYPTED BY FAKECRY! Your personal files have been encrypted with a strong algorithm. Your unique victim ID: FC-1783235621-uhjwghnb To decrypt your files, you need to pay 0.5 Bitcoin to: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa After payment, send an email to [email protected] with your victim ID and transaction ID. You will receive a decryption tool within 24 hours. Any attempt to modify or rename the files will result in permanent data loss. Do not turn off your computer until the encryption is complete. TIME REMAINING: 72:00:00
Emails
Wallets
-
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
Extracted
Path
-
C:\Users\Admin\Downloads\READ_ME_FAKECRY.txt
Ransom Note
- YOUR FILES HAVE BEEN ENCRYPTED BY FAKECRY! Your personal files have been encrypted with a strong algorithm. Your unique victim ID: FC-1783235620-bnlu0ugg To decrypt your files, you need to pay 0.5 Bitcoin to: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa After payment, send an email to [email protected] with your victim ID and transaction ID. You will receive a decryption tool within 24 hours. Any attempt to modify or rename the files will result in permanent data loss. Do not turn off your computer until the encryption is complete. TIME REMAINING: 72:00:00
Emails
Wallets
-
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
Targets
-
- Target FakeCry.exe
- Size 36.7MB
- SHA256 9e77b5b8439fe908dcfb088fd9e11beaabc21fb0c01dab40e14acada9a0e0086
Score10/10-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application