General

  • Target

    Repter.exe

  • Size

    436KB

  • Sample

    200712-epzchx1p2a

  • MD5

    784d27170c1761184cef189fa4889cc6

  • SHA1

    625dfcece6874d9bfd81020004c648e15588e518

  • SHA256

    5ef2a211e48b408b0e5c9dfac30683e8f7eb83231c11e25c01368b0ef1868ea1

  • SHA512

    c4696ce309e5986344d372289830645099c70021d7e2e7bbdc4ff6192e369e9b29604773f065f9cf284d61bc2979a98136bdbb3c3eb1caf6c44b5baa68319d08

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\How To Decrypt Files.hta

Ransom Note
Don't worry about anything, you can return all your files! All your files documents, photos, databases and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. Our Email = repter@tuta.io Your Personal ID = 50FB6E43 What guarantees do we give to you? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 3 file for free. File must not contain valuable information Don't try to use third-party decrypt tools because it will destroy your files. !! we 100% able to restore your files !! Discount 50% available if you contact us first 48 hours after 48 hours you should pay Double (Include this id in your message or email) in case of no answer in 2 hours write us to this Email = Repter@elude.in if you don't know how to buy bitcoin you can use this link https://www.coindesk.com/information/how-can-i-buy-bitcoins the easiest way to buy bitcoin is localBitcoinshttps://localbitcoins.com/ Attention: Don’t delete any files or rename encrypted files If you using other applications to decrypt, it may damage your files Don’t find your backups? they have been Successfully encrypted too or securly wiped.
Emails

repter@tuta.io

Repter@elude.in

Targets

    • Target

      Repter.exe

    • Size

      436KB

    • MD5

      784d27170c1761184cef189fa4889cc6

    • SHA1

      625dfcece6874d9bfd81020004c648e15588e518

    • SHA256

      5ef2a211e48b408b0e5c9dfac30683e8f7eb83231c11e25c01368b0ef1868ea1

    • SHA512

      c4696ce309e5986344d372289830645099c70021d7e2e7bbdc4ff6192e369e9b29604773f065f9cf284d61bc2979a98136bdbb3c3eb1caf6c44b5baa68319d08

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Disables Task Manager via registry modification

    • Modifies Installed Components in the registry

    • Drops startup file

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

2
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

File Deletion

2
T1107

Modify Registry

3
T1112

File Permissions Modification

1
T1222

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks