e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16

General

Target
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
Size 112KB
Sample260713-pv3jwsbs8t
SHA256 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
MD5 9a7f87c91bf7e602055a5503e80e2313
SHA1 193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA512 d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
SSDEEP 3072:yGdtoUTLVtbfcgYMIAN06WJBmc+sFqxF5QIPxdt:yGdtoUTDbfZRgJBmce+Ift
TLSH
T1E4B39E93B290C037D5D220B152956FE6DBBAEC34453A9C53D3E45AD64E60882FF1A2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Default\# DECRYPT MY FILES #.txt

Ransom Note

C E R B E R ----------- Your documents, photos, databases and other important files have been encrypted! To decrypt your files follow the instructions: --------------------------------------------------------------------------------------- 1. Download and install the "Tor Browser" from https://www.torproject.org/ 2. Run it 3. In the "Tor Browser" open website: http://decrypttozxybarc.onion/D2A7-F768-6D53-0006-404A 4. Follow the instructions at this website --------------------------------------------------------------------------------------- �...Quod me non necat me fortiorem facit.�

URLs

http://decrypttozxybarc.onion/D2A7-F768-6D53-0006-404A

Targets

- Target
  e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
- Size 112KB
- SHA256 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
- MD5 9a7f87c91bf7e602055a5503e80e2313
- SHA1 193f407a2f0c7e1eaa65c54cd9115c418881de42
- SHA512 d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
- SSDEEP 3072:yGdtoUTLVtbfcgYMIAN06WJBmc+sFqxF5QIPxdt:yGdtoUTDbfZRgJBmce+Ift
- TLSH
  T1E4B39E93B290C037D5D220B152956FE6DBBAEC34453A9C53D3E45AD64E60882FF1A2CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence ransomware trojan
- Contacts a large (8233) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Adds policy Run key to start application
  persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1