samsam | 29862b91d8f4ea197988857a6b44d41cf4e92ccad1fae7db4150e8ece3897fce

General

Target
samsam.zip
Size 92KB
Sample261024-d34w5sstas
SHA256 29862b91d8f4ea197988857a6b44d41cf4e92ccad1fae7db4150e8ece3897fce
MD5 6defdf62cf0428266fa42097aa22e0d8
SHA1 f361b3552a0c2a13da23ad6a1358c9e15c6630c0
SHA512 9498690acc77f043ca2d1d259c1751c4fb9128d21ce992fd252965888c322b1c98889d500bfe39ad143f432ea8a1493f4bcfe13ef91eb236fb86830ac9bd313a
SSDEEP 1536:MJCiOg2xEojk6v5L7tQVFhyAAvJuswX39EfxWDCoFxLEMOahOAjI9J5P31TF:MsRZasQFhyAaJua5eFEMOlb9J5P1TF
TLSH
T1AC9312405EF1BD9683089DF964B8276BB42D550DACC6586305E2CB09FF3A37EF8A7124
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note

#What happened to your files? All of your important files encrypted with RSA-2048, RSA-2048 is a powerful cryptography algorithm For more information you can use Wikipedia *attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files #How to recover files? RSA is a asymmetric cryptographic algorithm, You need two key 1-Public key: you need it for encryption 2-Private Key: you need it for decryption So you need Private key to recover your files, All of your network computers files is encrypted with one public key, So you need just one Private key to recover all computers files The private Key that we will send works on all your computers #How to get private key? It's not possible to recover your files without private key, You must send us 20,000$ USD in Bitcoin about(50 BTC) to receive private key For all affected computers After that we send your private key in our blogs. *Our blog address: https://www.anonyme.com/Blog/pikasoart *Our Bitcoin address:1FpZFUGqAkyjAGVgHXhaHrSmThJHxd2a7v We check our Bitcoin address every 2 hours After that we receive Bitcoins we send your Private Key in our blog #What is Bitcoin? Bitcoin is an innovative payment network and a new kind of money. You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us #How to buy Bitcoin? There are many way to buy Bitcoin and deposit it into your account, You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party #How to use private Key? We send you a simple software with private Key And you just need run this software on each computer that encrypted and all affected files will be decrypted #deadline You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files

URLs

https://www.anonyme.com/Blog/pikasoart

Targets

- Target
  samsam.exe
- Size 191KB
- SHA256 2f294d301d8bb9b947f41faf20df104710d5c4b2f469145d4e469ca7d1998b2f
- MD5 ddb102441a810f15bb87b0f6f39d152f
- SHA1 01b22392287258d6f751df9b858f57d5e1c90b9e
- SHA512 c562a9050c987ef85a5b87795e2ba84f7b629ef3873ef2c669c5b8b6421755b468fd225ed5de4f06345dd5badf11849d9272eb3bc1b24a124b34a323b8a02050
- SSDEEP 3072:4dp01i6vcHV1LI5FLV0pZeZKfOJizjrBnNtRg+ur199Jpo9DWro0n:X1i6UHVyLV0poZa1jrD099Do90
- TLSH
  T1EF146B2433D4C172E0A71D3546B5C3B24F7FB8769A29998FBBC906790F22794DA2131D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution samsam impact ransomware spyware stealer trojan
- Family: SamSam
  SamSam ransomware is a custom infection used in targeted attacks.
  trojan ransomware samsam
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2