07e694f81e57a93d885ff3ff51ebd31acc7260ec9ddfe8fcc4a9f97ec88f510c

General

Target
idkikdikdikdikdidkdiddi.exe
Size 365KB
Sample260808-maek8avcrd
SHA256 07e694f81e57a93d885ff3ff51ebd31acc7260ec9ddfe8fcc4a9f97ec88f510c
MD5 07d015f6c4ad0f2e7857fb6ae9e07df3
SHA1 aff931e0e337a1e995b42c5fe297226b6e1ce213
SHA512 149064bba6d35f47cf5c881f7e8affd997f7000f2622c39deb888e1d7284967fa46dd9500ee968000643bd03482997c41550ecc53b2989226d52079ed64c71a3
SSDEEP 6144:txEZwfNSPYm1ESU3SPRpowRBZQbL1Ay6etyJOhcRXxZbdsanl6N:tTECjOZQbhd6C8acRhJ6anlo
TLSH
T14B847D19FBA404F9E1B7D17CC9634501EB727C9A4770AACF23A44AA61F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : XHBCZSSI IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : OAGGWFQT IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

- Target
  idkikdikdikdikdidkdiddi.exe
- Size 365KB
- SHA256 07e694f81e57a93d885ff3ff51ebd31acc7260ec9ddfe8fcc4a9f97ec88f510c
- MD5 07d015f6c4ad0f2e7857fb6ae9e07df3
- SHA1 aff931e0e337a1e995b42c5fe297226b6e1ce213
- SHA512 149064bba6d35f47cf5c881f7e8affd997f7000f2622c39deb888e1d7284967fa46dd9500ee968000643bd03482997c41550ecc53b2989226d52079ed64c71a3
- SSDEEP 6144:txEZwfNSPYm1ESU3SPRpowRBZQbL1Ay6etyJOhcRXxZbdsanl6N:tTECjOZQbhd6C8acRhJ6anlo
- TLSH
  T14B847D19FBA404F9E1B7D17CC9634501EB727C9A4770AACF23A44AA61F236D09E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2