61da5fd1cbfea2f8b18e0fb1722c82d82fa0291985d788edb5c7c9ee2f1f1d1e

General

Target
61da5fd1cbfea2f8b18e0fb1722c82d82fa0291985d788edb5c7c9ee2f1f1d1e
Size 215KB
Sample260916-jttmpsab43
SHA256 61da5fd1cbfea2f8b18e0fb1722c82d82fa0291985d788edb5c7c9ee2f1f1d1e
MD5 73793db923afc0a9af2cf9a7c12729d4
SHA1 9ee083b1f94138637fb6d4cba9ba7c494c5dbe7f
SHA512 968fd423613f967923148eb5dba69bd88dbfd9ae733ca9e6274eef990f4a8985e4cc841675ad80f33ae65d79b5b6b93bd408ea8b857612b1a5252748dfcd5fbe
SSDEEP 3072:Q4etnkTI+nvzSMI8XGQyklXnDg1laxFwDHSVOZyulkZFTI/hVym:rsMn+T8XGEXqgsNZyF0rym
TLSH
T1C02412E8CBA0C19BE20B543D9D9D983133721A6902DD68E5B3F498C6B53D319FF54523
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Microsoft Office\#HOW-TO-RESTORE-YOUR-FILES.txt

Ransom Note

$ >>> All Your Files Have Been Stolen And Encrypted <<< $ - Attention !!! - All your important files have been stolen and encrypted by our advanced attack. Without our special decryption software, there's no way to recover your data! * - Your ID: [54C91855] - To restore your files, reach out to us at: Just Telegram - You can also contact us via Telegram ID: @Ultra_cryptor77 * - Why Trust Us? - Before making any payment, you can send us few files for free decryption test. - Our business relies on fulfilling our promises. <!> Warnings: -[ Do not go to recovery companies. They secretly negotiate with us to decrypt a test file and use it to gain your trust and after you pay, they take the money and scam you. You can open chat links and see them chatting with us by yourself. - Do not use third-party tools. They might damage your files and cause permanent data loss. ] - How to Buy Bitcoin? $? - You can ask us to introduce you to exchanges that work with your country where you can buy and pay for Bitcoin. - You can purchase Bitcoin to pay the using these trusted platforms: - https://www.kraken.com/learn/buy-bitcoin-btc - https://www.coinbase.com/en-gb/how-to-buy/bitcoin - https://paxful.com

URLs

https://paxful.com

Extracted

Path

C:\Users\Admin\Desktop\#README!.hta

Ransom Note

<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="x-ua-compatible" content="ie=9" /> <title>Encrypted by @Ultra_cryptor77</title> <hta:application id=Encrypted applicationName=Encrypted selection=yes scroll=yes contextmenu=no innerBorder=no windowState=maximize minimizeButton=no singleInstance=yes sysMenu=no /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <style type="text/css"> body{ background-color: #1a0000; font-family: Arial, Helvetica, sans-serif; color: #ffffff; } .head{ width:90%; margin: 10px auto; } .head img{ max-width:100% } .firstline{ margin-bottom:1rem; background:#2a0000; border: 3px solid #ff0000; box-sizing:border-box; border-radius:4px; padding:1rem 3rem; width:100% } .hit{ margin-bottom:1%; font-weight:700; font-size:1.5rem; line-height:100%; color:#ffffff } .hib{ font-weight:700; font-size:1rem; line-height:100%; color:#ffaa00 } .b{ padding: 10px; outline: none; } ul{ font-size: 1vw; } .Basicdescription{ color: rgb(255, 255, 255); font-weight: bold; text-indent: 10px; height: 30px; line-height: 50px; padding-top: 10px; font-size: 1.5rem; box-sizing:border-box } </style> </head> <body> <div class="container" style=""> <div style="text-align:center;margin-bottom:15px"> <img alt="" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII="/> </div> </div> <div class="firstline" style="margin:0 auto 20px;max-width:950px"> <div class="hit" style="text-align:center">!! All YOUR <span style="color:#ff0000;font-size:1.5rem"> IMPORTANT </span> FILES ARE <span style="color:#ff0000;font-size:1.5rem"> STOLEN </span> AND <span style="color:#ff0000;font-size:1.5rem">ENCRYPTED </span> !! </div><br> <div class="hib" style="text-align:center">Attention >> Please do not scan the files by antivirus, otherwise the consequences are your own</div> </div> <div class="b" style="background-color: #4a0000;"> <div class="Basicdescription">Basic description:</div></br> <ul style="color: rgb(255, 255, 255); margin-top: 0;"> <li>Please read the file (#HOW-TO-RESTORE-YOUR-FILES.txt) after reading this page.</li> <li>We need your ID and your ID is written below the (#HOW-TO-RESTORE-YOUR-FILES.txt) file.</li> <li>Contact information for decrypting is written in the file (#HOW-TO-RESTORE-YOUR-FILES.txt) and also at the end of this page.</li> <li>copying or moving any files could DAMAGE the cipher and decryption will be impossible.</li> <li>Trying to recover with any software can also break the cipher and file recovery will become a problem.</li> <li>Boot and recovery errors can also damage the cipher. Sorry about that, but doing so is entirely at your own risk.</li> <li>Contact us only in our Telegram, otherwise you can run into scammers.</li> <li>All leaked Data samples will be Disclosed in 4 Days if you remain silent.</li> <li>Time is very important. If you lose time, the price will increase, so we better value time..</li> </ul> </div></br> <div class="b" style="background-color: #4a2200;"> <div class="Basicdescription"> Is there a guarantee for decryption after payment?</div></br> <ul style="color: rgb(255, 255, 255); margin-top: 0;"> <li>Before paying you can send us up to<u> 2 test files </u>for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)</li> </ul> </div></br> <div class="b" style="background-color: #4a3300;"> <div class="Basicdescription"> Contact information for decryption:</div></br> <ul style="color: rgb(255, 255, 255); margin-top: 0;"> <li>If You Want To Restore Them Telegram Us : <span class='mark'><a href='https://t.me/Ultra_cryptor77'>https://t.me/Ultra_cryptor77</a></span></li></br> <li>Your ID: Your ID is on the files </li><br> <li>Before paying, be sure to send the test file. If the test file is decrypted and sent to you for free, pay. Otherwise, do not trust and do not pay.</li><br> </div> </ul> </div></br> <div class="b" style="background-color: #2a2a2a;"> <div class="Basicdescription"> About ransomware support:</div></br> <ul style="color: rgb(255, 255, 255); margin-top: 0;"> <li>If You Want To Restore Them Telegram Us : <span class='mark'><a href='https://t.me/Ultra_cryptor77'>https://t.me/Ultra_cryptor77</a></span></li></br> <li>If someone who is in contact with you through email steals from you, you can contact us and send us the documents and get decrypted for free and the offender will be fired.</li> <li>If you have information about the company and its servers, share with us in Telegram and receive a share from us when they pay. Don't worry, your identity will remain hidden.</li> <li>We are ready to answer your questions!</li> </ul> </div></br> <div class="b" style="background-color: rgb(0, 33, 74);"> <div class="Basicdescription"> Things that you must pay attention to:</div></br> <ul style="color: rgb(255, 255, 255); margin-top: 0;"> <li><b>DO NOT </b>trust anyone except the Telegram that is in the help file, otherwise we will not be responsible for the consequences.</li> <li><b>DO NOT </b> rename encrypted files.</li> <li><b>DO NOT </b> try to decrypt or manipulate the files yourself.</li> <li><b>DO NOT </b> contact intermediary companies. They don't do anything special, they just message us and give us money and get the key, but if our price was $50,000, they will charge $70,000 from you.</li> <li><b>DO NOT </b>pay any money for the test file.</li> <li>It's a win-win deal. You get access to your encrypted files and data, and we get paid to decrypt your files. So think wisely and don't waste time.</li> </ul> </div></br> </body> </html>

URLs

http-equiv="Content-Type"
http-equiv="x-ua-compatible"

Targets

- Target
  61da5fd1cbfea2f8b18e0fb1722c82d82fa0291985d788edb5c7c9ee2f1f1d1e
- Size 215KB
- SHA256 61da5fd1cbfea2f8b18e0fb1722c82d82fa0291985d788edb5c7c9ee2f1f1d1e
- MD5 73793db923afc0a9af2cf9a7c12729d4
- SHA1 9ee083b1f94138637fb6d4cba9ba7c494c5dbe7f
- SHA512 968fd423613f967923148eb5dba69bd88dbfd9ae733ca9e6274eef990f4a8985e4cc841675ad80f33ae65d79b5b6b93bd408ea8b857612b1a5252748dfcd5fbe
- SSDEEP 3072:Q4etnkTI+nvzSMI8XGQyklXnDg1laxFwDHSVOZyulkZFTI/hVym:rsMn+T8XGEXqgsNZyF0rym
- TLSH
  T1C02412E8CBA0C19BE20B543D9D9D983133721A6902DD68E5B3F498C6B53D319FF54523
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery execution persistence privilege_escalation ransomware spyware stealer upx
- Renames multiple (9567) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1