General

  • Target

    alt.bin.zip

  • Size

    1.1MB

  • Sample

    200813-9dxdx6s52x

  • MD5

    93e25d829d01e60b057ad0e8e1aca10d

  • SHA1

    a5ac337a53220d97fdc31a8d95cbfafed8e4992c

  • SHA256

    1a562dfa68723f6670fc2ed1e52196cc0af94a00bae123c3fca040b16ae3f08c

  • SHA512

    2756e7feb33d1d2001ee60733a29f60d3483e40f1508ae25ad107c9d243efa660c51e014ddf0cfd334c203fff8afe62bf1cb351714ce25e19541daf10e33a7e7

Score
10/10

Malware Config

Extracted

Path

C:\\NEF1LIM-DECRYPT.txt

Ransom Note
Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: AlanMorbenhal@protonmail.com Killianoprahh@protonmail.com MonicaTuskmarka@tutanota.com
Emails

AlanMorbenhal@protonmail.com

Killianoprahh@protonmail.com

MonicaTuskmarka@tutanota.com

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Targets

    • Target

      alt.bin

    • Size

      3.0MB

    • MD5

      5235242923a537b58b7064082dad7432

    • SHA1

      2a044e5e3dde62ded6a3f2a5a634067168a41810

    • SHA256

      c2b9f3b84e3e990e2c225e05ea65e7a3aaaf5a688864d0ee68ed2eece557fac0

    • SHA512

      6811036c65152f772b6f2e539b7bec657cb0cc7255f8b00271e5d51017e4734a2ebee18133c38411ee4eb0acb3803b030fa19e009d3cb7b95f721098488213bd

    Score
    10/10
    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

MITRE ATT&CK Matrix

Tasks