General
- Target 4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c.zip
- Size 1.1MB
- Sample260817-wxaefsch93
- SHA256 c5fd650725f2a238a800cd9291748f42509f4a57d3ffdda07983f3066fd64b70
Score
10/10
Malware Config
Extracted
Path
-
C:\#ReadThis.HTA
Ransom Note
- Your SERVER/COMPUTER is encrypted by us ! _ Hello Admin/Guest! [6DD772DB] [ENCRYPTER] => Do you want to decrypt your data? [ENCRYPTER] => To trust us, first send us a 100-200 KB file, we will decrypt it to build trust for you. [AFTERTRUST] => What should you do after building trust? Help ( All your data is encrypted, If your data is important and you want to decrypt it, You must pay the bitcoin amount set by us, Send a message to our emails first, after pricing, us and your trust, Do a Google search to buy bitcoins, For example: "Buy bitcoins in rubles". After purchasing Bitcoin, you must transfer the Bitcoin to our wallet, After payment, the decryption tool will be sent to you along with how to execute it properly ) ENCRYPTER@server ~ $ To contact us, first send a message to our first email. [FiRsT Email:] [email protected] ENCRYPTER@server # If your email is not answered after 24 hours, our email may be blocked. So send a message to our second email. [SeCoNd email:] [email protected] King Of RansomLIZARD Ran$omW4rE function Start() { window.resizeTo(800,680) } function copytext(s) { window.clipboardData.setData("Text",s); alert(s+' copied to clipboard'); } function Restart() { alert('Attention! This important information for you!'); }
Extracted
Path
-
C:\#ReadThis.HTA
Ransom Note
- Your SERVER/COMPUTER is encrypted by us ! _ Hello Admin/Guest! [0A5070AD] [ENCRYPTER] => Do you want to decrypt your data? [ENCRYPTER] => To trust us, first send us a 100-200 KB file, we will decrypt it to build trust for you. [AFTERTRUST] => What should you do after building trust? Help ( All your data is encrypted, If your data is important and you want to decrypt it, You must pay the bitcoin amount set by us, Send a message to our emails first, after pricing, us and your trust, Do a Google search to buy bitcoins, For example: "Buy bitcoins in rubles". After purchasing Bitcoin, you must transfer the Bitcoin to our wallet, After payment, the decryption tool will be sent to you along with how to execute it properly ) ENCRYPTER@server ~ $ To contact us, first send a message to our first email. [FiRsT Email:] [email protected] ENCRYPTER@server # If your email is not answered after 24 hours, our email may be blocked. So send a message to our second email. [SeCoNd email:] [email protected] King Of RansomLIZARD Ran$omW4rE function Start() { window.resizeTo(800,680) } function copytext(s) { window.clipboardData.setData("Text",s); alert(s+' copied to clipboard'); } function Restart() { alert('Attention! This important information for you!'); }
Targets
-
- Target 4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c
- Size 2.2MB
- SHA256 4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c
Score10/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Detect suspicious telegram bot
Detect suspicious telegram bot.