Show this thread
#Annabelle #ransomware. Scary messages, replaces Userinit so only the ransom screen is displayed. Appends ".ANNABELLE" to encrypted files.
Hash: 0f743287c9911b4b1c726c7c7edcaf7d
https://app.any.run/tasks/97b3c641-56ca-457e-914e-42412fb6b3ac …
Also disables a ton of tools using old-school IFEOs.pic.twitter.com/dRMK3KTfPm
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Interesting. If you let the timer run out, it BSOD's the system (I missed it, think it was a 0xFD or something), then gives this screen. Bugger even runs in safe mode.pic.twitter.com/nPleWhqMzi
-
Dump of the payload writing the MBR https://beta.virusbay.io/sample/browse/e6457c006c6bbce7fbde83794f501572 …
End of conversation
New conversation -
-
-
Attribution:
@alsjamiesonThanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
There is literally no info on this ransomware online. Why was your tweet the only thing on the internet that told me the way to get past the ransom screen was a fresh copy of userinit?
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.