466d3d195b5842076cb5db4ef76ca7b956710f47daa30cf57a125582e390926d

General

Target
idkikdikdikdikdidkdiddi.exe
Size 256KB
Sample260818-csct8svway
SHA256 466d3d195b5842076cb5db4ef76ca7b956710f47daa30cf57a125582e390926d
MD5 7f17fef5f3a5a71df65dde0c5937fc4a
SHA1 61e2ca3588bbdc4cefe4c2110440c2e83ea5c519
SHA512 13728fc1c2706ed7a5993f8efb727f2c3f9d427e27e3f89648044cba9fa135504434ce3d6729aac37c4b44fd0e18f1ae24c5416809d5ec10257a71e3fa61ae49
SSDEEP 6144:ZRBpkLe+Ji1Iy4DX3hc0farLxZwxj4E85HjKLchzSvZhcOMAy1XnC6cRfDW:Z/pOJi1Iy6X60uLxZkj4E8tGVvI7XnCk
TLSH
T11C441204A63B50BECF94C4F1C86B8FFA69647A9504A8AE3BA395C3F71B601E54D0F109
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : MDUKBRPD IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

- Target
  idkikdikdikdikdidkdiddi.exe
- Size 256KB
- SHA256 466d3d195b5842076cb5db4ef76ca7b956710f47daa30cf57a125582e390926d
- MD5 7f17fef5f3a5a71df65dde0c5937fc4a
- SHA1 61e2ca3588bbdc4cefe4c2110440c2e83ea5c519
- SHA512 13728fc1c2706ed7a5993f8efb727f2c3f9d427e27e3f89648044cba9fa135504434ce3d6729aac37c4b44fd0e18f1ae24c5416809d5ec10257a71e3fa61ae49
- SSDEEP 6144:ZRBpkLe+Ji1Iy4DX3hc0farLxZwxj4E85HjKLchzSvZhcOMAy1XnC6cRfDW:Z/pOJi1Iy6X60uLxZkj4E8tGVvI7XnCk
- TLSH
  T11C441204A63B50BECF94C4F1C86B8FFA69647A9504A8AE3BA395C3F71B601E54D0F109
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ransomware execution persistence privilege_escalation spyware stealer
- Disables Task Manager via registry modification
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2