Analysis
-
max time kernel
141s -
max time network
37s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
01/06/2020, 15:29
General
-
Target
24ada19b269279612370bdf16f2becc1d5b7e0f69821050e2d9b48cfc874dca0.bin.exe
-
Size
19KB
-
MD5
8bd00c45b95cc40192efc84ff20c391f
-
SHA1
15774ff1aa7d1c16332c5c54a4c7e9322ccddcdd
-
SHA256
24ada19b269279612370bdf16f2becc1d5b7e0f69821050e2d9b48cfc874dca0
-
SHA512
be4dafda0efee22138e5b85e9f9b90ab099a17cd2953b3122b112e624981a9d7389ccc13c2be100a734e29083be5efe20305aa4d753c8bc4d7b7b61157f01da4
Score
10/10
Malware Config
Extracted
Path
C:\SIGARETA-RESTORE.txt
Ransom Note
Two things have happened to your company.
==========================================================================================================================
All of your files have been encrypted with military grade algorithms.
The only way to retrieve your data is with our software.
Restoration of your data requires a private key which only we possess.
==========================================================================================================================
Information that we deemed valuable or sensitive was downloaded from your network to a secure location.
We can provide proof that your files have been extracted.
If you do not contact us we will start leaking the data periodically in parts.
==========================================================================================================================
To confirm that our decryption software works email to us 2 files from random computers.
You will receive further instructions after you send us the test files.
We will make sure you retrieve your data swiftly and securely and that your data is not leaked when our demands are met.
If we do not come to an agreement your data will be leaked on this website.
Website: http://corpleaks.net
TOR link: http://hxt254aygrsziejn.onion
Contact us via email:
[email protected]
[email protected]
[email protected]
URLs
http://corpleaks.net
http://hxt254aygrsziejn.onion
Signatures
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24ada19b269279612370bdf16f2becc1d5b7e0f69821050e2d9b48cfc874dca0.bin.exe"C:\Users\Admin\AppData\Local\Temp\24ada19b269279612370bdf16f2becc1d5b7e0f69821050e2d9b48cfc874dca0.bin.exe"1⤵
- Sets desktop wallpaper using registry