f4283ef74cbdcbbc6f75daae483dbe44749d101e2c9d1bcc4a6cbc9bdf6a8e79

General

Target
idkikdikdikdikdidkdiddi - Copy.exe
Size 258KB
Sample260823-fdqdkaxwht
SHA256 f4283ef74cbdcbbc6f75daae483dbe44749d101e2c9d1bcc4a6cbc9bdf6a8e79
MD5 e64fd0e9356d034e32bd3e31a729b4d6
SHA1 6231616c8f749c19b4a9145583e8a3352eff4001
SHA512 204ddf88d046c7405bc2978b5759f76bf95376762c6c6d638ff4377fe638f9def1f25f9aa97c46c1f704bd3350c7e0c631c560682a2debe2e1f96e3d95ec185f
SSDEEP 6144:aLDfJph+hLUii3LpREBKHwhMlShOAoOCNP3GvnfhA4sF1lO:aLDfJph+pNi3LwBKHVSvSfGfQ14
TLSH
T1D244125621ABA0FCCE6796B585958F74FA64FCC301A22E3BD391E1713D36A018B7C846
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : RYSBVXZE IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : WBOMRQRB IP : 85.203.46.34 YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

- Target
  idkikdikdikdikdidkdiddi - Copy.exe
- Size 258KB
- SHA256 f4283ef74cbdcbbc6f75daae483dbe44749d101e2c9d1bcc4a6cbc9bdf6a8e79
- MD5 e64fd0e9356d034e32bd3e31a729b4d6
- SHA1 6231616c8f749c19b4a9145583e8a3352eff4001
- SHA512 204ddf88d046c7405bc2978b5759f76bf95376762c6c6d638ff4377fe638f9def1f25f9aa97c46c1f704bd3350c7e0c631c560682a2debe2e1f96e3d95ec185f
- SSDEEP 6144:aLDfJph+hLUii3LpREBKHwhMlShOAoOCNP3GvnfhA4sF1lO:aLDfJph+pNi3LwBKHVSvSfGfQ14
- TLSH
  T1D244125621ABA0FCCE6796B585958F74FA64FCC301A22E3BD391E1713D36A018B7C846
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2