95de374db5b22e32ecdc48002a27a6a75d19fdbba619fee31359f27bf6babed4

General

Target
idkikdikdikdikdidkdiddi.exe
Size 133KB
Sample260802-lnq1qsxtay
SHA256 95de374db5b22e32ecdc48002a27a6a75d19fdbba619fee31359f27bf6babed4
MD5 7c6b769302c412b60f4cd35285999196
SHA1 2a2149f140c85bd3c8bb3fec3115409300d30349
SHA512 66ff21b1270251553c0557ba80ad42d6bdba1633747ad3048c3cea2683391c597f00664d2fa12c25cfbc6baa5ab26c5af8c0945a268235493dc6fae2a4b29fe4
SSDEEP 3072:UZFenGq+LiUp4c7puvspX7C1j0UWoitgIbGb6:yenBbUp4spX7C1j0UWoikb6
TLSH
T110D34B1AB6690179D276D6B8CE934502EB72BC954771ABCF03904DA60F33AD0AF3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : XHBCZSSI IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : YRWKJLDU IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

- Target
  idkikdikdikdikdidkdiddi.exe
- Size 133KB
- SHA256 95de374db5b22e32ecdc48002a27a6a75d19fdbba619fee31359f27bf6babed4
- MD5 7c6b769302c412b60f4cd35285999196
- SHA1 2a2149f140c85bd3c8bb3fec3115409300d30349
- SHA512 66ff21b1270251553c0557ba80ad42d6bdba1633747ad3048c3cea2683391c597f00664d2fa12c25cfbc6baa5ab26c5af8c0945a268235493dc6fae2a4b29fe4
- SSDEEP 3072:UZFenGq+LiUp4c7puvspX7C1j0UWoitgIbGb6:yenBbUp4spX7C1j0UWoikb6
- TLSH
  T110D34B1AB6690179D276D6B8CE934502EB72BC954771ABCF03904DA60F33AD0AF3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2