General
-
Target
bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118
-
Size
713KB
-
Sample
240618-mnlaxszckh
-
MD5
bb7b70fcd01eb0903c7ecf2a8a50cbea
-
SHA1
22694b981fe9c6c9bedd6045299b55e564ebf8e8
-
SHA256
dacddfaece889da8a311107c5923313c6682acce5c718b5ae49550a1e15b24d0
-
SHA512
64ac24534d043b01dafad22f79af7649443c5dcd809fadeeac7faa08c04b1e73f33230e9f8d2824dfd90bedb30222c61f8490b7ee307ac753b146978a799c54e
-
SSDEEP
12288:8d8z9JklKqDlVGzfLPQU4dFC19BqR0o8lPFaV0pJVAyp5tAiRmKz:8Wpgc7yFC19Bs+tpJV5RmK
Malware Config
Extracted
djvu
http://cjto.top/nddddhsspen6/get.php
-
extension
.kolz
-
offline_id
hZcC4PEfaqDNIXxy0ProMPOAk3JS3K1JoUqoq0t1
-
payload_url
http://cjto.top/files/penelop/updatewin1.exe
http://cjto.top/files/penelop/updatewin2.exe
http://cjto.top/files/penelop/updatewin.exe
http://cjto.top/files/penelop/3.exe
http://cjto.top/files/penelop/4.exe
http://cjto.top/files/penelop/5.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-18R6r7GGG8 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0252Ijrfg
Targets
-
-
Target
bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118
-
Size
713KB
-
MD5
bb7b70fcd01eb0903c7ecf2a8a50cbea
-
SHA1
22694b981fe9c6c9bedd6045299b55e564ebf8e8
-
SHA256
dacddfaece889da8a311107c5923313c6682acce5c718b5ae49550a1e15b24d0
-
SHA512
64ac24534d043b01dafad22f79af7649443c5dcd809fadeeac7faa08c04b1e73f33230e9f8d2824dfd90bedb30222c61f8490b7ee307ac753b146978a799c54e
-
SSDEEP
12288:8d8z9JklKqDlVGzfLPQU4dFC19BqR0o8lPFaV0pJVAyp5tAiRmKz:8Wpgc7yFC19Bs+tpJV5RmK
Score10/10-
Detected Djvu ransomware
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Renames multiple (160) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Modifies file permissions
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-