Resubmissions

23-09-2020 10:35

200923-mkwlt9yalx 10

23-07-2020 14:59

200723-mtbw6t99d2 10

23-07-2020 13:47

200723-5t3mhtw95x 10

General

  • Target

    build-x64-crypt.bin.zip

  • Size

    22KB

  • Sample

    200923-mkwlt9yalx

  • MD5

    bbd3fe70b7063821c3e0aab4895f270e

  • SHA1

    86f7aa738e472c99355410e8875cc7c0b6936d48

  • SHA256

    d7d0688022b5848caf5cbabc1bde628cb74f32e014311f5299ed63241fff72b0

  • SHA512

    6948295e7beaa1b10d2219afe2f5eedb002f757d406bc39d069c48e71c88c1a80733ae0cc4dedccfa5e06d592a4a55c7b3c47534d273e5509016598b5e1ac86b

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\Ejdgcj-decrypt.hta

Family

exorcist

Ransom Note
Ejdgcj Decrypt All your data has been encrypted with Exorcist Ransomware. Do not worry: you have some hours to contact us and decrypt your data by paying a ransom. To do this, follow instructions on this web site: http://217.8.117.26/pay Also, you can install Tor Browser and use this web site: http://4dnd3utjsmm2zcsb.onion/pay IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data! Your authorization key: rKVYb/4uYQisWzdJsLmE3MCYrBkNeRx+njcZrAZE64UKRyGa8O2gQeQJ2hnddc1c bBrY+agIgwL+W85GIM8WI0N0bIezVBdHO+4j8HFsZxbhfJFGattz4rmXyBAQ2aXo X+EBr2SIhZ7VMF9oU5OwOCLJjIl8B2lcmaaXsWm6SLytwu6U4Hd9NbccpHNKdtCM 2hpmwkfoBf3zfzxA5ABQn582eonk0NFprOPKstsy/RBKBZb9xb2RSAayqPr+mmfy LeBD487QF5JQ+I+BFXD2BWS5U1bLBnJvKqarkseY295XNcN73Cfsn/UqkWuPSKXu HWROx48WYTBOGZACDFMs+6c/nm5CU1vhXbYDLPfgJ6LiTLdmd/IE/IIrUqReyhTe nxOrSc9H13s3mgwBThG/0O4EVqgsRXBfHyrL3umCBpOcGXphEtPoZx58E/4HtRrC pIjWhyO8Gw9SJSOavE8l4OVY5k6ygKgfA6Tj0gKHl42fjxhO3rFDieX0Pusp56pn iUQMv6HMQbHPLrmepXIa+W1FgNeVvbeWM+Mu+tpPCFVsWQ8uYduXZGRgkJW8opM5 chhrmINFA918FzttIC+SyD7Q0kn9xNGArEYsn1iScLNJwJvdOl5O9jIliSZFszqJ ANOJNhMrrjvJjPNJi3YJ7zzDiBALPo0opeGizFRJbs629NZn1S8JB+xmVmEakXXO tD+d2pzVgOzEWoqEgHQs/FRiB8DfkjoNMu2NpXrshJfV7lC/9Iw32a6UghX8JGJL Oy0avvFmZatx2uHYzuVj+DSuHcRJcUWvKrDuDsrPmoUMgGF/IMFVAvhloTBaHCGD t5OunZxJpqdRLo0p9C5iFLHi6Ebv70ezNFE+3dxvOFMynj3h73l8ckZtccjOO1Bn +cjXUqg+2holWR2Qw0f2AV+79V0x8Ddo0AJRFlbv58tkfoFptubkE/lLON+luWCo n17+uQ2II8SqHEICmwbTlVt9Sva+t9smv1YuHBiXNar5x+1Bylnzset39TV/6wxh EkSB/Z4Lb2shZAHYTTeuYFxdAUyGn1gnzZ2BfMhAj045QcmUoD4hFsq9adLf4e5L elwfqD/9UgxqFV/H1jCZQjN9UJ1hN7NtJYknNpB2LqV8mBkZj/ALQVQoBbav4JCV aFwyvsWyxp8oCpNOUF8mo9S9AiOMsJwJoWVK7ddmevEZGGkUA++lfnTAhruCDXkb 4BLOrVDSF09+CXD1VNbmm22fMkgObx8gEqDML5zPjwoCoIgQEqpcyt3CLOpky5gq JmPYccSNgzbNlEvYdXC4JtbjvyNjdTuANs/1I5Q1O2n2Ur3S6zcbG2r0d04BihYz YDbFPecikm2TGkFWtDFv/sG+LuJE8G4XVSya70pfDK1laI52QszdwUfIzZJzpb1d J2Q0/XwR+k7W2gH+oh0z9qFPIH40Tosz9bJHKGZF59O4o3LsINAzkINmJfYb5xLV S4+NBGiw6tYw7OF8aY3CjniKDsKqFlXg4urrG53/9qQrw1ZR1PqnH7aKX/hTJy28 tR5o42NNlmyiFh+OyYKzwI6PNchrkJ2OSuTNtqut/nv2rUFXTdKiHYy/7KTXwDUg UVZpg4ThLxg9MzHIXBj/x9TACf0Uwk6+vB4CH6MLSBDxH13i8jmjBZxaqc97gUhV xAjUbRrXp3NslAczaLI2dV2yAvHX28z45PM1JNihcQJx5lDQKDGt62wGagoFAd3C s8jb7mGvxZHgb2NDVGmFHSixdrL3cGY30DtF6zoqjOruAorbC35RLDyXbnI/3ibu 7FXhJpI0vHgZ8ZWKj0dPYak6sDwf4Pl54pUwjJea1VwgZjo84oWgPUDeEwXXMjeW jW7nSL1hTPTKeC/acrzhkoNmzuJZNeUQC6NuTu1LW52ZCyxxYokUNh20dymPk5FH e8J70u5noWjECDtjUwg6Q843MsfUFRkWFWL7gYkrNPS/yMZaCTrU63GaMWxbzsIJ yJbpf8AQYxce36+601sjmSOiCupdmU1hHEVdVDH8fNnwewOfX8d1/RuOJpJKQq8c Z94Emyc5+ldcB4UTnW8f4OnHPgVAnLGa4b9EWTTdY6SARjxdfvr/8ixXpMI2QGlC d7VfplNkyKel7V0kVMnRvxrYvh1X4rLOo5n0yrsX9cGea1r0fWhBCr2Hjppx49QW RT+2+B5hVQfhhErO7YsSX52I2niZrbqH+S6iSmQGkGu9/sPS/Ub2ffOTW7lwvhcB D3nqCYgPnm3EtkKINI+Nmb9wDblhBIurVQg+OfD2UiI0La9Gw3z4fOza2cf/yNkk dZOslQvzLthHectMjb/WQ2cyLf6kSCcOi/nD/jAFAldHw0uflT/f218pqgzQD0fb EXEVAUghpP1OxFciql4TW/kZ1ksJ+99yx6bJVPyig1pBB60gvyoWVuALPwzZgPK7 WkKQk5H5rBEU8/hfCzCtDXTvxrg2OblQ7BVNYJYvBPHgWVjQPDAxlfhn+YcJAQUE pRCMl7UX76iB8hQbIuuH9TCOgmP852/MH1KDVtV6ccjlvy2QPJQ/60jErZhPYPaF J/NC2O8DhvDTsp0UOhOwZ7oj4GT0dSZwXqrcoW6dItrOLflQ5Tr1SXkNLSfRSYwB /UL6GnPiQqHo3OwPNOt10lp820w0F4Skp6liEOoB7tIp7tA0cHJ5dNK3MuGGrHSL Gxjyu3uN40SNvgCq0WybXf+1UpMxb/djY6uA/dxP/2cCfaghW0uJWeeQ33kHyjkB IiFxfTaYseer8pk2D0ZB6mW0yWLL9eyXHSQdOKBN//q7DYWiNyyMd4oJxIv7qtcc wbb3K7CVOEwf0q2PXBpFfkVaAl1BuNdxfXPz3s4gSgwZs3bYEInIAiB+m0pQW5cH dHDPlrqpSqmRc7hMOnHIB5y1i+++x5QTnO4imyGasWjtp+XdQGEtyZ/YfkU+VNzL zohWA/YnAOeBlALWld1W/bg+MxWjvUu/BZ5tHrBtcjb6IW2kxjtCfrQGVhziK1FF gzZjePVfjknGzvTJNvWApuI+0GOwsOaTyqT3+Zv5pY5sXLwXobZPYCUExishZGCV rNYly6bfYFzKBHeaS0QFDR2Q5khQPMqR/MCfQKS2StEbLSeqrdSlKAffkyojB5Kx M69sZcwKbTjDXxcDq5X8KJNxHbnseGcBla3iZCCljNWXS4IebrzScgspedJ0cSEp snUtgz99hrcYG+G2z5BAIumPHWEIXvXWRvjH4zxlmpW1g1UqtMmVLet4XD43gknb TQanse1GHB660zfzHrmJwUOOdnBsPn6oXSlXIGCEi26Yd5pevI9zdeYqKSQSVBB/ fDb2pMxVgSY4TuaAw4yyti1V+Nmaai1aFsjhST2UzSGWouSypHcKE4tysLOmjIF1 yl5YPw2Hdt9V9jB8gTXWxERMknI1aSU7JzeXw7BwloGkuyiYYsrwdhDfHfqG4BCb PYx63znjfx2VVfZXIOSb9lFFB29j30XXJGZCTbAePg4bOFfoIXwhxqplj/ucbko4 sDF010Lyjdf9IKLmh8P9Vf6GtbVVNpcxWKTodl8YivBlST8zcl6wVoLj25EhwQwH KyK6iwehYtSee1+5KdjXXIBabkCHxqwAF2MUXX+X292Ys4Y3OGkxiipP+y7WDiKR euiMfTAEjfj55GRSC5TR0vXKU7icslkxQowk+vHH4oiA4COBDwYVSkMyrp6wlJY8 Xu8jwCktenzHBz3Ty+frg+1fKtRcf/g1p8PjYwgHyPBYvGsxm8BsbQfJXoLcaKGD ZJUGJWaytLnVKGM3lvOUWmlMWDkgTrUmuXYFQAEdqKvCgYJZWfD4mODCWZg70MaH qZABLQXmIlkGG4MCvnoS3vDefr4zGVNxUgmWja+i7Y7adxjjTmlpksgnm2bkdi0a PHHwurgl7x5WDxiSYHyVJGgNSM7BoZBp3Ne+da1XevqbOl/VSsIRtqAshTDKa1hR
URLs

http://217.8.117.26/pay

http://4dnd3utjsmm2zcsb.onion/pay

Extracted

Path

C:\Users\Admin\Desktop\ArlomQ-decrypt.hta

Family

exorcist

Ransom Note
ArlomQ Decrypt All your data has been encrypted with Exorcist Ransomware. Do not worry: you have some hours to contact us and decrypt your data by paying a ransom. To do this, follow instructions on this web site: http://217.8.117.26/pay Also, you can install Tor Browser and use this web site: http://4dnd3utjsmm2zcsb.onion/pay IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data! Your authorization key: lxW9+z277KhRHN3GT048nvwO7mSAujfiEk28LUWcdG9AfhwiVro46HXsiGhNjBiR cozXDg6PCKGvDM2xoiusQ95HhJktkNiLCgOJV6R0bp/KbiPZMTQ1uhtXgvJfTxg4 hgwKJ5jsY7pQv5k+Pl9oUQvrWIpv7B3YNZvrRwN5NB5uLC8Uf/M0gwYIA/yhd5Cd 8coEyD02NLNiFJWpVy8MG/470s5lmAXrydIoqNymSbqVQ5OAUICc8QwvmNU0NgTw ZDrbNhEkphVjA2Ut6f+61cQCPjVnJnZa/O0Ik8xXtXyfLO04jKp1fWONrWXTfFPp TZuThzdkZTeK1vONlzJXEueQzBfMTViJ3VvNzCgU2HwspbdRDj7Q1fssACBNbYcd 2B8kz8qZdEebHtmh4DiS24AZpjZDNR+gLCDYaxa0Cke5HMkDg2noWeOES8JRROgq 6fL9iBEXOBxZZgJIFpsCrLPRwXUdU0VkhV/SGTFz3EjWdXcP95M04vnaBoKCBDsC EtYHIztcVftfHUqNO0FYCYGw5bvnJIeubH87p8dRCPkmBPbS88cgSOuTuTS7Pzei DOjsc/deSVLOIGFs7VRk4jQUMa2l938ZO0j+nWKYhlj1w5eSLFHPqBQoxRjTMWfs wL4dDKikXbk2JfUx2DO6k7R/qAEexlmGYoC4eDNzCS1dDqijJTN5EVu0L3JfecEE 9kiNJ6l22pLCd941vqbgWrYcOxAHeF9ZUTxlZIgcXHuRo6Yupgy+TU0iQxJADQFf crwdUUAbp6kc4phGg6n673vhyuhJpJcwGuKalefOPjwh25L7o3PfwgDaKrEhJxMg erVIoIfFecur8jv4kkb5poBOSMjkl+zUO3qpuKk9cj9MbGxdqz7F7HQxcXkIRw1x pM0J8CzfyUHjwmNI4utqEGkcjDBszBLaJtUg4qhT44hWoXbDXE6LkGZyXkvR4f6U u9A/ZisZ6H0ibCLGWETPEnjUzT+kTUl+P5wvALkO3CdPw/hehPRPJtuqFdi9Q2F7 //3Vj/L3mUqI5NZ5S896pjEcPQQWgmUxeQHBw51KNm9Oc5AymvsKTjOSouS/pfoX 3wF/ogP6vGxiOP7gAQvdGnQC//FgZi0Zh4ulD3ZZNrGJG2qBxwDz8ony6YUKO0DD HDE1YxDbVUfxJVgMzLseq2xCc4hng6e0o7VdHEgqVELOvLz9UmU3ofan0AEoGq9M irG/CHCvSZqbZXJFuVM/OXgD9+RtR2vN7b1JngbDdwPwWj79uTzNdla0179zphQM n5KbHZWYAmXz1YHPy+fHcyMl9uAob848REF8Xn53+eHBTwloLnMPcMhMqOhhPSJe 5oaBsfymaB5yM5S+mKFIc9Tt39vQsFvHa4/6wyAqjlxzGCwsG4OZusY6v1Dg3DaU oJ5RjltIinufQPDue2BXvfFmBAtelWckFKEMUiUSjGdOoJkxAtuX6e30sQqzYjnW ujfC6BeK+VoKgbxi5xSB2tm60nJU07xqthpjWM/Yvh7PZdC4wkVtqJcWaQXItNKJ fWbpWm5I25BpmFZT8ejlG0SUZACapkIGXe2vbiOYVq4iKeAGSWNyt9X6gSfGjOkw 5EU1I65d5BqY3++7qo8yUi+zDZr111KLduJycdNaKsGhv0DxB8srmTCCet0i8mUv 8Om4T2NNxO8/rXS8wdHh0SmWEejVzS1TAEEqHZbv/JWEmXauZtLcVQS2PtPVLUvV 9R6tmHC80ezMDwz6sFVPqpUw3GrzODzNTMcNYVjLfoZZDZPVG9Y5PDImBXld5oBB ZgjntA0EaydTYcxrZJG1zox88AO0Kc17hWGfnbyP+jiUQ0INgFZ5pR2xEcZXFL1P N8LFEqgmpYklmMyeccDgpT+mMhKEiOEpotVM/QhMRlt5JbrF1oSN8jaoQzlhqMON pOgQsGFaXFDFvAXt6y2tsuFtqXNdlp54C01fp8KUJ/EVvPuBi4sHGL6r/7qynNV6 QZuon2xLKIY5p2Lol6K9dqBN+gyraowHwtv2oZWAQrhOQeloo1UOaycYbNeiZqLQ XLNEpI7qC7h9ruYScjvcRVz3vYzi1SHvcl7n60DCY1XMcc3Cdq1qakPjf8aL77Uv l7j6ZGypRQGprjBMSt+9kNgzwe6nxcrCj0ah5pNxqm8GA9tNPf03zcUZmir9kzg5 LG212DN3bZp45mVcNWdt5YDUin0mrwuX0hYItpAStRu1Vh5qtrGoopG42NEccdW5 Q7q5Zrh+F7tYzBvg8EaQYn1mKVqIN+VhLV1jWrZHpd8bYlUcOLh9R0iGVisZ3GPV mNAWZqWEJNWbqkqkBhhCebOiH0r6F3kbNonxgDTpd7lO3YytRDGFr2SnYwlgz1oe yWzFZK13qwHUKPN6s5NfvnJUe8MsqDIKirWcYDSpuJZa9ZkCVLJdo/d6W36JMRtV rBqzeiR3d+ZTmmUaWdticAMcnzUH6fpQatqphSyuWMTCiOKqEyRLLywqnbuvsqX7 40H/wlnf1NrkWIreUPPLyAjZnrZrd7YQk4Ud1wOOuK1n7dFC/yMTBEKrrzJrYnRd FZaxC13mi2HXXefoKfgACWReQR9n/mQU0Hp1DsLjBRWjm8hBV8Yb6rSRCN9kXBLr C2JtdVymcT0dIKlrPGasuX0qUhAOCIAGpSHZ8EPMr7dX/zgl6O6J4lr31c7wt/r6 QydSxhkobNFKZQe/BjckVQ2EujL6DpSejgvXVWOCqf89cQueBooZfAB/Z276Xt/n ZEKdHhxVRHaJ+eclXIV2ZTAMyCkPR24DTqv58nbJli6e3cIMcOB2M54bDydtILpO bNA1khb+Nzmx5Q5taZu8hISfzYoiq37ZXQT0USpaBPHctVJMf2lEOqh1XAMrnXgT eDEKOCXy+qYrgsVN8Ihu3Jt2Uwfodrx3Nmt1n5pQUQ7jFJocioaBxkkUzIXPdleL vf/mFk/xfeqeDIfujG0+he74m2Sjh6ytZ57gwatg6+a6dER3mXb+W4YTiyPFOZA/ tEJ8GgjmCN1iI/nbdnDEZOubxiBvT4bwkITnMs5jl6/CqvC6QBNXafkjR4AYotgo 5z4GLh+xn8oSKUYUNsptZwakwfY2yJpxjqkjgqAWVuoEceGao3I2l34NebGtsOf8 ceeifqGqyMI053Kop8VWQHo0bUAuGDGhACOpFvHbAg8LtyaCzLiaxTVPit6QhbjK VIavgO/Iryc6DHErpwc+LsK9hS+Wf4aBoWGcg8dmu92vPyzNCvD7LNDY1y9HYitI exKIO4PU5K5ozBZhtU5yO3lF2roR+XvfRrSiPtfRF6NHcX0Dd5P29LqBbG3u0EuP 3INaW9lEE6D230kWMJUWX11SsSmNE3MNqf3BRh6mWf1GuWnxHnbmjbEydHXS90WR si2ckXR5fV3fgVMGkC0Qv1qy9lmYY4D8KBTgo6f6x5Rrpv02Y1H5IV7smxYO3pgP HVRgK3rqxD/7DZtWguphkJvrw2jvi/v1RHvWn4AI1Jl6Elayysl4o/oVGkS7rD2l T21he4WaZ5piB3u4lSiEge2oBBo+RgE6sGAwezx1Hi8L8mpmelo6c60GAF4Vof/d rfS+P1hyiRcZksUKjs7L4TDbeIRv44II+ZnIuNdHlhJ//vcOFPIc1uoofS1iOgWj ZwZ9SGI4AGgEeh/jZ11/QMacEXbZX5SiNCGfmF3RZG04xkvCppWLZRxRmbd6W2a4 l8s+mgi32HRxptoSBwo/yD5Tlvc5NEua68rdTuWhiyKTgDZbpAinCmsleTlk/owK 7AuQvU3qupU121wnfVxcJu/AamriiJ2uyDXSSLG2jL5W52PESl1LG1LgeJxLAA0V FzH1Abpp6r/Ew9JWnPiXbSsfbH8/7BoZYlfuqdxvMuu+jiIiocqwk2/Qgobvraa4 38kSUm91cUnBEmO66pfsObEYCou1sX6SceEjvEUa+MLx/yaur8fMxyCkeS5pH6Iz
URLs

http://217.8.117.26/pay

http://4dnd3utjsmm2zcsb.onion/pay

Targets

    • Target

      build-x64-crypt.bin

    • Size

      52KB

    • MD5

      8cc13fea61cc0ba1382a779ee46726f0

    • SHA1

      bd8ef46a02085153605a87fcc047f7ef3d0c4131

    • SHA256

      eeb8a83d7532797d39d060ffb2a65562e8d803c4dbd8379289f99367cac2f850

    • SHA512

      2f317f04b6bda9af58b049cb9bd0032d08c0aa30b8ac8d76b10f738ab11f4cc9f4eca4af3ecf26e610715117e2d68e5f8fb0ac139e60e882cc24fc795bf0a34a

    • Exorcist

      Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

1
T1031

Defense Evasion

File Deletion

3
T1107

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

4
T1490

Tasks