Overview

overview

10

Static

static

200bc25fa0...68.exe

windows7_x64

10

200bc25fa0...68.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    200bc25fa093ce65f41baa1c3efe02dcc238b04cb57a6fc5ee87da1e04d6e168

  • Size

    352KB

  • Sample

    200529-7vyvv1q9qn

  • MD5

    166244c2351bf9c164a887f48b53882a

  • SHA1

    263188e9bdeec2b13e3b4a19730eff44fb804c5f

  • SHA256

    200bc25fa093ce65f41baa1c3efe02dcc238b04cb57a6fc5ee87da1e04d6e168

  • SHA512

    00f175762fa9dba2515cff3d61a13222ed7834f38cc7c66f17a1e1ae5421da323360bdae9873f1c615962b7cbf7527cffc0f5ef4c9a0df21c9d4ba64883663ec

Score
10/10
evasionpersistenceransomwarespywaretrojan

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-910373003-3952921535-3480519689-1000\howto_recover_files_mlwxe.txt

Ransom Note
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen ? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://6fjhsy630.ylk768dhg67fj.com/61F5D9E75E5916CB 2. http://djru34dnd.lgk749kch8ej.com/61F5D9E75E5916CB 3. https://7vhbukzxypxh3xfy.onion.to/61F5D9E75E5916CB If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: 7vhbukzxypxh3xfy.onion/61F5D9E75E5916CB 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://6fjhsy630.ylk768dhg67fj.com/61F5D9E75E5916CB http://djru34dnd.lgk749kch8ej.com/61F5D9E75E5916CB https://7vhbukzxypxh3xfy.onion.to/61F5D9E75E5916CB Your personal page (using TOR): 7vhbukzxypxh3xfy.onion/61F5D9E75E5916CB Your personal identification number (if you open the site (or TOR 's) directly): 61F5D9E75E5916CB
URLs

http://6fjhsy630.ylk768dhg67fj.com/61F5D9E75E5916CB

http://djru34dnd.lgk749kch8ej.com/61F5D9E75E5916CB

https://7vhbukzxypxh3xfy.onion.to/61F5D9E75E5916CB

http://7vhbukzxypxh3xfy.onion/61F5D9E75E5916CB

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1231583446-2617009595-2137880041-1000\howto_recover_files_jlmod.txt

Ransom Note
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen ? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://6fjhsy630.ylk768dhg67fj.com/5B4F49854903D7E 2. http://djru34dnd.lgk749kch8ej.com/5B4F49854903D7E 3. https://7vhbukzxypxh3xfy.onion.to/5B4F49854903D7E If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: 7vhbukzxypxh3xfy.onion/5B4F49854903D7E 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://6fjhsy630.ylk768dhg67fj.com/5B4F49854903D7E http://djru34dnd.lgk749kch8ej.com/5B4F49854903D7E https://7vhbukzxypxh3xfy.onion.to/5B4F49854903D7E Your personal page (using TOR): 7vhbukzxypxh3xfy.onion/5B4F49854903D7E Your personal identification number (if you open the site (or TOR 's) directly): 5B4F49854903D7E
URLs

http://6fjhsy630.ylk768dhg67fj.com/5B4F49854903D7E

http://djru34dnd.lgk749kch8ej.com/5B4F49854903D7E

https://7vhbukzxypxh3xfy.onion.to/5B4F49854903D7E

http://7vhbukzxypxh3xfy.onion/5B4F49854903D7E

Targets

    • Target

      200bc25fa093ce65f41baa1c3efe02dcc238b04cb57a6fc5ee87da1e04d6e168

    • Size

      352KB

    • MD5

      166244c2351bf9c164a887f48b53882a

    • SHA1

      263188e9bdeec2b13e3b4a19730eff44fb804c5f

    • SHA256

      200bc25fa093ce65f41baa1c3efe02dcc238b04cb57a6fc5ee87da1e04d6e168

    • SHA512

      00f175762fa9dba2515cff3d61a13222ed7834f38cc7c66f17a1e1ae5421da323360bdae9873f1c615962b7cbf7527cffc0f5ef4c9a0df21c9d4ba64883663ec

    Score
    10/10
    ransomwarepersistencespywareevasiontrojan

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies system certificate store

      evasionspywaretrojan

    • Program crash

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

5
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks