General
- Target 5f6633dda54e45d6744da7c49f59ff337e7004d7ddac542c80cd253ba9cc4967
- Size 1.3MB
- Sample260812-rc27hsydmc
- SHA256 5f6633dda54e45d6744da7c49f59ff337e7004d7ddac542c80cd253ba9cc4967
Score
10/10
Malware Config
Extracted
Path
-
C:\ProgramData\Adobe\INC-README.txt
-
inc_ransom
Ransom Note
- Inc. Ransomware We have hacked you and downloaded all confidential data of your company and its clients. It can be spread out to people and media. Your reputation will be ruined. Do not hesitate and save your business. Please, contact us via: http://incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion/ Your personal ID: DE20CD82551F352E We're the ones who can quickly recover your systems with no losses. Do not try to devalue our tool - nothing will come of it. Starting from now, you have 72 hours to contact us if you don't want your sensitive data being published in our blog: http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/ You should be informed, in our business reputation - is a basic condition of the success. Inc provides a deal. After successfull negotiations you will be provided: 1. Decryption assistance; 2. Initial access; 3. How to secure your network; 4. Evidence of deletion of internal documents; 5. Guarantees not to attack you in the future. Instruction how to get to chat page: 1. Download TOR Browser from official website (https://www.torproject.org/download/); 2. Install TOR Browser and open it; 3. Copy chat link and press enter; 4. On the page you will need to register your account using your personal ID; 5. Use this ID and your password to get chat page again.
URLs
-
http://incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion/
-
http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/
Targets
-
- Target 0cb4e7d35eb3f4585c6168988247e30d99ef24d3ef006d91971e3913ef593c42.exe
- Size 1.9MB
- SHA256 0cb4e7d35eb3f4585c6168988247e30d99ef24d3ef006d91971e3913ef593c42
Score10/10-
Family: INC Ransomware
INC Ransom is a ransomware that emerged in July 2023.
-
Renames multiple (288) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry