2048d382a3a32abbec1e54380dc52fa384b54ba9e8df629c649b70541a8463d3

General

Target
test.exe
Size 248KB
Sample260822-d6pavs1ane
SHA256 2048d382a3a32abbec1e54380dc52fa384b54ba9e8df629c649b70541a8463d3
MD5 1af68e97d1b0f1d4a889c9b55928473b
SHA1 e7b41761a729b775562c0cd7873823c545d0af6c
SHA512 6d3e42422c379d5b50250780a724af8f522b9dc52ac696973a0bb4a8bc2d310334b7ddb14a548a8f5d3d658261ff05f9e18c1a4fb0614353be1db8af1b60f419
SSDEEP 6144:Da0ddYSCFGHaYKncc/lKocjCTe1lsj73G0LjDY:+0diFFGHGnnftTewhDY
TLSH
T17B44129DB64BB0BEEB018230DDC55DB0B634BAD204165E3EDAECD6388BD1941C5B5C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : TIGMGOLM IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : YRWKJLDU IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

- Target
  test.exe
- Size 248KB
- SHA256 2048d382a3a32abbec1e54380dc52fa384b54ba9e8df629c649b70541a8463d3
- MD5 1af68e97d1b0f1d4a889c9b55928473b
- SHA1 e7b41761a729b775562c0cd7873823c545d0af6c
- SHA512 6d3e42422c379d5b50250780a724af8f522b9dc52ac696973a0bb4a8bc2d310334b7ddb14a548a8f5d3d658261ff05f9e18c1a4fb0614353be1db8af1b60f419
- SSDEEP 6144:Da0ddYSCFGHaYKncc/lKocjCTe1lsj73G0LjDY:+0diFFGHGnnftTewhDY
- TLSH
  T17B44129DB64BB0BEEB018230DDC55DB0B634BAD204165E3EDAECD6388BD1941C5B5C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2