General
- Target 0e5bd98bcf1ef9bef39f19f41e1aabfb.exe
- Size 1.3MB
- Sample211205-j8fdmacbgp
- SHA256 31f84b5a677f3be143c04055bf0d6dc79433332d98e7fd89c68429c2192ac385
Score
10/10
Malware Config
Extracted
Path
-
C:\Boot\bg-BG\Read_Me.txt
Ransom Note
- Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101ZRSUVXZA 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs
-
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101ZRSUVXZA
-
https://yip.su/2QstD5
Targets
-
- Target 0e5bd98bcf1ef9bef39f19f41e1aabfb.exe
- Size 1.3MB
- SHA256 31f84b5a677f3be143c04055bf0d6dc79433332d98e7fd89c68429c2192ac385
Score10/10-
Modifies Installed Components in the registry
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext