General
- Target f366ab9c4638fd82350d7689d7b050b6939d2adda6e1fcd8cfd204dec22dc26e
- Size 81KB
- Sample260814-lykayagh99
- SHA256 f366ab9c4638fd82350d7689d7b050b6939d2adda6e1fcd8cfd204dec22dc26e
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files\README.TXT
Ransom Note
- YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. If you found this document in a zip, do not modify the contents of that archive! Do not edit, add or remove files from it! You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Download the (Session) messenger (https://getsession.org) in messenger :ID"0585ae8a3c3a688c78cf2e2b2b7df760630377f29c0b36d999862861bdbf93380d" Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails
URLs
-
https://getsession.org
Targets
-
- Target f366ab9c4638fd82350d7689d7b050b6939d2adda6e1fcd8cfd204dec22dc26e
- Size 81KB
- SHA256 f366ab9c4638fd82350d7689d7b050b6939d2adda6e1fcd8cfd204dec22dc26e
Score10/10-
Renames multiple (6009) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.