Overview

overview

10

Static

static

3

95cfd76bfe...44.exe

windows10-2004-x64

10

95cfd76bfe...44.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44.zip
  • Size 8.2MB
  • Sample260805-nbj3rsem51
  • SHA256 75d62394bee4fdcbcc366ae6e17532b8b8abadad4a689eeabba514ae1b190d6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
demonwarepersistenceprivilege_escalationpyinstallerransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\README.txt

Ransom Note
  • Your files have been uploaded to our server and encrypted! They cannot be decrypted without our key, which was generated individually for your computer. The only thing you can do now is to buy a key and a decoder within 10 hours! If you do not, after 10 hours your private key will be deleted from our server, you will lose your encrypted files forever, and we will publish your files on the internet. Send 0.006 Bitcoin to the BTC address: bc1qhffuqkuwmenevjq6erfkfr043qv2dlgujq4h0g Then send the transaction ID and your ID to the following email address: [email protected] or [email protected] We respond to emails only after receiving the payment. After payment, we will send our decoder and decryption code to your computer within a few hours. You just need to run it and it will ensure that all the files are automatically decrypted (unless you have renamed or changed them)! Don't worry, if the conditions are met, all your data will be restored and deleted from our server. We have no reason to cheat you after payment. < < Where can I buy and send Bitcoins?> > The easiest way to buy Bitcoins is through the LocalBitcoins website. You need to register, click the "buy bitcoin" button and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins or https://bitcoin.org/en/buy https://buy.moonpay.io Here you will also find other places to buy bitcoins and a beginner leader: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ ATTENTION! Antivirus software, third-party services, or any other person cannot decrypt your files, and attempts to change, rename, or move your files may damage them, and even we cannot recover them. YOUR ID:'as4064t'0fd4b'96ea3657229487a24d110ed0f0fb871d'

Extracted

Path

  • C:\Program Files\README.txt

Ransom Note
  • Your files have been uploaded to our server and encrypted! They cannot be decrypted without our key, which was generated individually for your computer. The only thing you can do now is to buy a key and a decoder within 10 hours! If you do not, after 10 hours your private key will be deleted from our server, you will lose your encrypted files forever, and we will publish your files on the internet. Send 0.006 Bitcoin to the BTC address: bc1qhffuqkuwmenevjq6erfkfr043qv2dlgujq4h0g Then send the transaction ID and your ID to the following email address: [email protected] or [email protected] We respond to emails only after receiving the payment. After payment, we will send our decoder and decryption code to your computer within a few hours. You just need to run it and it will ensure that all the files are automatically decrypted (unless you have renamed or changed them)! Don't worry, if the conditions are met, all your data will be restored and deleted from our server. We have no reason to cheat you after payment. < < Where can I buy and send Bitcoins?> > The easiest way to buy Bitcoins is through the LocalBitcoins website. You need to register, click the "buy bitcoin" button and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins or https://bitcoin.org/en/buy https://buy.moonpay.io Here you will also find other places to buy bitcoins and a beginner leader: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ ATTENTION! Antivirus software, third-party services, or any other person cannot decrypt your files, and attempts to change, rename, or move your files may damage them, and even we cannot recover them. YOUR ID:'as6561t'0fd4b'17d1d264f5776630a14afd80bcec6ae9'

Targets

    • Target
      95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44.exe
    • Size 8.3MB
    • SHA256 95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    demonwarepersistenceprivilege_escalationransomwarespywarestealer

    • Family: DemonWare

      Ransomware first seen in mid-2020.

      ransomwaredemonware

    • Drops file in Drivers directory

    • Boot or Logon Autostart Execution: Print Processors

      Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

      persistence

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks