General
- Target XwormBuilder_vmtest.exe
- Size 3.2MB
- Sample260730-wpc6daxvdw
- SHA256 85794404583143bc8baf6425811e653574e177cc322a785df3fd5f3d8b893a92
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\INSTRUCTIONS_9090.md
Ransom Note
- # YOUR FILES ARE ENCRYPTED All your data has been locked with AES-256. **Your PC ID:** `6164306462303936` **To recover your files:** 1. DM `kovakb` on Discord 2. Send your PC ID 3. Pay the ransom 4. Receive your decryption key **Do NOT:** - Rename encrypted files - Use third-party tools - Reinstall Windows *You have 72 hours.*
Extracted
Path
-
C:\Users\Admin\Videos\README_RANSOM.txt
Ransom Note
- YOUR FILES ARE ENCRYPTED All your documents, photos, videos, and databases have been encrypted with military-grade AES-256. To recover your files, you must DM "kovakb" on Discord. Your PC ID: 6164306462303936 Do NOT: - Rename encrypted files - Use third-party decryption tools - Reinstall Windows These actions will result in PERMANENT data loss. You have 72 hours.
Targets
-
- Target XwormBuilder_vmtest.exe
- Size 3.2MB
- SHA256 85794404583143bc8baf6425811e653574e177cc322a785df3fd5f3d8b893a92
Score10/10-
Clears Windows event logs
-
Renames multiple (111) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.