84758bd05b0176a3863c213af33e4241afd386628ce34ba033ea510826af016f

General

Target
k2ufvrj.exe
Size 1.3MB
Sample260924-yz43ysvxfz
SHA256 84758bd05b0176a3863c213af33e4241afd386628ce34ba033ea510826af016f
MD5 bdf8388558a6b0b9df439e539c90f3f9
SHA1 f5976e41db0f1d928a51494d50ca7235132e033f
SHA512 9b35ba1cd0f346337b48e3b6c48a7ae6aa81d7ef6dffcfe1dfe0c26b2f8d45c707f119907181cfbe2731ba63b84165846979fa1d65d1651fdaf9df84729faa07
SSDEEP 24576:v0UIsPTwmovypTwM7FHZ4+mhciE7Us6fB/M2hNu:1TwmozMBa+mh3dsS/M2
TLSH
T11E5529307E5599BDC15BC07082468AA21E3130CB0F39B9FF459996393F7AAF52E3C658
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\CONTACT US.txt

Ransom Note

Do not panic; everything is going to be just fine. Just read carefully -- WHAT HAPPENED? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< Your network has been compromised by Fiasco. All files are encrypted using a military-grade AES encryption algorithm. A large amount of your sensitive data was exfiltrated. We usually download: - Personal data: CVs, DL, SSN, PII, NDA contracts, etc. - Financial information: documents, payrolls, bank statements, bills, transfers, budgets, annual reports, etc. - Customer data: contracts, PII, contacts, purchase agreements, etc. - Confidential: source code, trade secrets, technology, blueprints, documents, etc. - Work files, databases, legal documents, corporate correspondence. - Accounting data. - Audit reports. -- WHAT DO WE OFFER <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< If you want all your files back just the way they were And if You want to prevent your sensetive data ending up in the wrong hands, you need to contact us. Here's how: Download and install Session Private Messenger app from this url: https://getsession.org/download Make an account and send a message to this account id: 05e892bbd91a3812070997206ec5a92067006edf20bfa048dde4821c834264e008 Introduce youself using your unique Public Key. This is your Public Key: g1ds7 We use it to identify the unique key that was used to encrypt all your files. Use it to identify yourself. Wait for our reply and be patient. Do as we further instruct you. --- WHAT IF I DON'T CO-OPERATE? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< We have the most powerful data leak site on the Internet. There are a lot of journalists, researchers and other hackers and criminals that would be interested in using your data for free. An incomplete list of risks you are facing in case of faluire to co-operate ( besides permanently losing all your files. ): - Fraud - Identity theft - Loss of customer trust and loyalty. - Damage to the company's reputation. - Legal consequences and compliance fines. - Financial losses and costs associated with data recovery. - Impact on competitive advantage and market share. - Breach of data privacy regulations and laws. - Disruption of business operations. - Reduced employee morale and productivity. - Potential for intellectual property theft. - Loss of trade secrets and proprietary information. -- KEEP IN MIND <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< - No matter what the AI or the authorities say about this, there is only one way to get your files and that is through us. - You WILL get your files back. - Once you got your files, you will never hear from us or about this incident again. - Do not try to decrypt using third-party software. You will damage the files. - Do not report to the authorities. They don't care about you or your business.. - Do not hire a recovery company. They can't decrypt without the key and we made sure any other kind of recovery is impossible. - Do not hire a middleman. Speak for yourself. - Do Co-operate. -- WE HAVE DONE THIS COUNTLESS TIMES <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< - Do as we told you and there will be no FIASCO. - This situation can be fixed very smoothly as long as you do as instructed.

URLs

https://getsession.org/download

Targets

- Target
  k2ufvrj.exe
- Size 1.3MB
- SHA256 84758bd05b0176a3863c213af33e4241afd386628ce34ba033ea510826af016f
- MD5 bdf8388558a6b0b9df439e539c90f3f9
- SHA1 f5976e41db0f1d928a51494d50ca7235132e033f
- SHA512 9b35ba1cd0f346337b48e3b6c48a7ae6aa81d7ef6dffcfe1dfe0c26b2f8d45c707f119907181cfbe2731ba63b84165846979fa1d65d1651fdaf9df84729faa07
- SSDEEP 24576:v0UIsPTwmovypTwM7FHZ4+mhciE7Us6fB/M2hNu:1TwmozMBa+mh3dsS/M2
- TLSH
  T11E5529307E5599BDC15BC07082468AA21E3130CB0F39B9FF459996393F7AAF52E3C658
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution impact persistence ransomware adware spyware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (157) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Deletes itself
  defense_evasion
- Stops running service(s)
  defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2