c279e2785ca454680e260f9b67f61c59e5378282a6854a4542cf40f9d9f6e800

General

Target
windowsupdate.exe
Size 23.9MB
Sample260714-2nfg1ae15j
SHA256 c279e2785ca454680e260f9b67f61c59e5378282a6854a4542cf40f9d9f6e800
MD5 1298314b82cbc3f9dd7fc4477eb733bb
SHA1 b6de832b1000d0f4572d67c7f01341f3a736a573
SHA512 497c8a8a5f0b2c677aa4117a20180f471e81a9665adb75f32c728e524d53c81e8b2b4a0a2128f9f9aa56b7950fd5e889cff5f5067b9b1b87b02bb2a17edd06ce
SSDEEP 393216:I1biodjs14bMgLc9zGdGthrBnK7gIfUKOcwr6tZq5XK86A+7y2fHsxtEDwe3MG1G:V2G4TLcNOiVo58KPwr6tZq563AOZPwt7
TLSH
T18C473355ABD12CA7FC97953D56E3C612A1B262341F6089DF17AA03693FB3280003E77E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\README_RANSOM.txt

Ransom Note

==================================================== Hopeless - YOUR FILES ARE ENCRYPTED ==================================================== Victim ID: 0Y6FWHICT9ZE6JRT What happened to your files? All your important documents, photos, databases, and other files have been encrypted with military-grade AES-256 encryption. How to recover your files? To recover your files, you need to pay $700 USD in BTC to the following Monero address: BTC: bc1q3vp3m5dnleszjcwhnzs5gxmcnfx9dfkl8fcny4 After payment, contact us at: [email protected] Telegram: @ransomwareeeeeeeee IMPORTANT: Do not attempt to decrypt files yourself. Any attempt may result in permanent data loss. You have 72 hours to make payment. After that, the decryption key will be destroyed and your data will be lost forever. ====================================================

Emails

[email protected]

Extracted

Path

C:\README_RANSOM.txt

Ransom Note

==================================================== Hopeless - YOUR FILES ARE ENCRYPTED ==================================================== Victim ID: CG7G7NCUSDVTRU61 What happened to your files? All your important documents, photos, databases, and other files have been encrypted with military-grade AES-256 encryption. How to recover your files? To recover your files, you need to pay $700 USD in BTC to the following Monero address: BTC: bc1q3vp3m5dnleszjcwhnzs5gxmcnfx9dfkl8fcny4 After payment, contact us at: [email protected] Telegram: @ransomwareeeeeeeee IMPORTANT: Do not attempt to decrypt files yourself. Any attempt may result in permanent data loss. You have 72 hours to make payment. After that, the decryption key will be destroyed and your data will be lost forever. ====================================================

Emails

[email protected]

Targets

- Target
  windowsupdate.exe
- Size 23.9MB
- SHA256 c279e2785ca454680e260f9b67f61c59e5378282a6854a4542cf40f9d9f6e800
- MD5 1298314b82cbc3f9dd7fc4477eb733bb
- SHA1 b6de832b1000d0f4572d67c7f01341f3a736a573
- SHA512 497c8a8a5f0b2c677aa4117a20180f471e81a9665adb75f32c728e524d53c81e8b2b4a0a2128f9f9aa56b7950fd5e889cff5f5067b9b1b87b02bb2a17edd06ce
- SSDEEP 393216:I1biodjs14bMgLc9zGdGthrBnK7gIfUKOcwr6tZq5XK86A+7y2fHsxtEDwe3MG1G:V2G4TLcNOiVo58KPwr6tZq563AOZPwt7
- TLSH
  T18C473355ABD12CA7FC97953D56E3C612A1B262341F6089DF17AA03693FB3280003E77E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence ransomware spyware stealer discovery
- Renames multiple (453) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2