Show this thread
#Annabelle #ransomware. Scary messages, replaces Userinit so only the ransom screen is displayed. Appends ".ANNABELLE" to encrypted files.
Hash: 0f743287c9911b4b1c726c7c7edcaf7d
https://app.any.run/tasks/97b3c641-56ca-457e-914e-42412fb6b3ac …
Also disables a ton of tools using old-school IFEOs.pic.twitter.com/dRMK3KTfPm
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Interesting. If you let the timer run out, it BSOD's the system (I missed it, think it was a 0xFD or something), then gives this screen. Bugger even runs in safe mode.pic.twitter.com/nPleWhqMzi
-
Dump of the payload writing the MBR https://beta.virusbay.io/sample/browse/e6457c006c6bbce7fbde83794f501572 …
End of conversation
New conversation -
-
-
Attribution:
@alsjamiesonThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.