General
- Target 0b71d4d1c712ea86e949ea7e9d22eaec.exe
- Size 835KB
- Sample220124-hsn56adfcl
- SHA256 5c90dc8a2bebed531a198159e4fc02c11aabf4a53eb6ce1036795db807e0fe44
Score
10/10
Malware Config
Extracted
Path
-
\??\M:\Boot\cs-CZ\Read_Me.txt
Ransom Note
- Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101DDDDDDDD 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs
-
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101DDDDDDDD
-
https://yip.su/2QstD5
Extracted
Path
-
\??\M:\Boot\bg-BG\Read_Me.txt
Ransom Note
- Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101NFGIKLNO 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs
-
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101NFGIKLNO
-
https://yip.su/2QstD5
Targets
-
- Target 0b71d4d1c712ea86e949ea7e9d22eaec.exe
- Size 835KB
- SHA256 5c90dc8a2bebed531a198159e4fc02c11aabf4a53eb6ce1036795db807e0fe44
Score10/10Looks for VirtualBox Guest Additions in registry
Looks for VMWare Tools registry key
Modifies Installed Components in the registry
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Drops desktop.ini file(s)
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Suspicious use of SetThreadContext