# Full WriteUp

Full Writeup on our website: [http://www.aperikube.fr/docs/nullcon_2018_osint1/](http://www.aperikube.fr/docs/nullcon_2018_osint1/)

-----

# TL;DR

In this task the author gaves us a ransomware hash. After passing it in virustotal. I saw the DSAdaDSDA.js JS dropper for Nemucod ransomware.

After a little looking on Google, I found the Hybrid Analysis report and found the username n923wUc in the HTTP Traffic.