da6d01ded185ef0f7ad6cc99815abd3dca19c14bb6e2f316d60b375b543cdd8d

General

Target
idkikdikdikdikdidkdiddi.exe
Size 358KB
Sample260802-lrkccsgc86
SHA256 da6d01ded185ef0f7ad6cc99815abd3dca19c14bb6e2f316d60b375b543cdd8d
MD5 31d14ee67ee87f3211705bae8d7893cc
SHA1 cfbfa5b1a2ef4865bedef9d1c20ef25415c5fe1d
SHA512 d10ebb544678a7860ed0c5585d12df68f241b727ebc2673c33562e49f2bb4ec91a835e45449fea6df3c9e5bc71d4be47c4f054383b44f953233c429d8faad8a6
SSDEEP 6144:iz5oYmWw/m21nz96VifGOYkykeXm7Y3jXt93KILV3H+nAbQ:Pr3AOJyke2E3jX3XLT
TLSH
T142748D19F7A514F9E167C17CCA624506EB727C8A07B1ABCF23A04A971F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : XHBCZSSI IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : DLAWBTBF IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

- Target
  idkikdikdikdikdidkdiddi.exe
- Size 358KB
- SHA256 da6d01ded185ef0f7ad6cc99815abd3dca19c14bb6e2f316d60b375b543cdd8d
- MD5 31d14ee67ee87f3211705bae8d7893cc
- SHA1 cfbfa5b1a2ef4865bedef9d1c20ef25415c5fe1d
- SHA512 d10ebb544678a7860ed0c5585d12df68f241b727ebc2673c33562e49f2bb4ec91a835e45449fea6df3c9e5bc71d4be47c4f054383b44f953233c429d8faad8a6
- SSDEEP 6144:iz5oYmWw/m21nz96VifGOYkykeXm7Y3jXt93KILV3H+nAbQ:Pr3AOJyke2E3jX3XLT
- TLSH
  T142748D19F7A514F9E167C17CCA624506EB727C8A07B1ABCF23A04A971F236D09E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Disables Task Manager via registry modification
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2