Overview

overview

10

Static

static

3

RansomSim.exe

windows10-2004-x64

8

RansomSim.exe

windows11-ltsc_2024-x64

10

Resubmissions

02/08/2026, 07:57

260802-jtjshafd2910

02/08/2026, 07:54

260802-jrvf8afc8610

Sharing

Copy URL Twitter E-mail

General

  • Target
    RansomSim.exe
  • Size 352KB
  • Sample260802-jtjshafd29
  • SHA256 84fc613b4471aa60eecdd1671b96f851ef219bc4dbb5c2ea708841fdd58d9e98
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note
  • *** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : FRPTRMXS IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

    • Target
      RansomSim.exe
    • Size 352KB
    • SHA256 84fc613b4471aa60eecdd1671b96f851ef219bc4dbb5c2ea708841fdd58d9e98
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryransomwarepersistenceprivilege_escalation

    • Disables Task Manager via registry modification

      defense_evasion

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks