General
- Target 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e
- Size 19KB
- Sample220105-g5gfeaachk
- SHA256 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\@[email protected]
Ransom Note
- ---------------Time Time Ransomware--------------- All of your document,pictures,videos are no longer accessible. We encrypted them ! We also stole your files,computer information,passwords,cookies. If you don't pay us, we will leak everything on the dark web. Please, find @[email protected] on your desktop to pay the ransom. If you don't find it, check your recycle bin or antivirus quarantine. We ask for 100€ of paysafecard (https://paysafecard.com) /!\ Warning /!\ Please, do not rename encrypted files. Do not use third party software. Do not try to decrypt the files yourself. /!\ Warning /!\ You got epicly pwned. ---------------Time Time Ransomware---------------
URLs
-
https://paysafecard.com
Targets
-
- Target 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e
- Size 19KB
- SHA256 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e
Score10/10xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Executes dropped EXE
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
Loads dropped DLL
Drops desktop.ini file(s)
Drops file in System32 directory