General

  • Target

    qeSw.bin.zip

  • Size

    89KB

  • Sample

    200929-5a3ldma5k2

  • MD5

    eb5d00b4e0a25d10626258492ab96939

  • SHA1

    0120fe873e9675847f78cfd4a0aca61be4e8f3a2

  • SHA256

    624203002e5446068ac625516c27f834ccd918e1625fb14e15379c00c3f8df06

  • SHA512

    3f1f853444996e463fd3b33ab90cf5f383c7f1aa50988b380e37212602e1fb46a67a9428f7ea2446726ab375dc778b7f8e40a812e59a8323056a5a36e39cfb2e

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\User Account Pictures\C907CC-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .c907cc -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_c907cc: ywmLIZ9uzc7dXCfe179iw4YFXqQ4o4MlU9re5DxgEvH7Wnp97r pRpNfVyHdSJuD5xqUxNLXyiQyuwIeaCzt9cAhmEizR8v9841Zj AieSimuinFM5girXPmeWWYhIYpDgx1d2FODUojQMXncqy1WOmS 7tmvBtpO40+APyMtMrPONe4133YAoOfqaxWh0acStKNt/ZzAu2 DCwcaBUXzQlFZswa+GZ9dUSupzlGC+Z+UDNTxniNvBHy/bhz4R 0nMxZKCkphzxKs8UKaClJvebD6foEbzRcZyT11hA==}
URLs

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\C907CC-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .c907cc -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_c907cc: ywmLIZ9uzc7dXCfe179iw4YFXqQ4o4MlU9re5DxgEvH7Wnp97r pRpNfVyHdSJuD5xqUxNLXyiQyuwIeaCzt9cAhmEizR8v9841Zj AieSimuinFM5girXPmeWWYhIYpDgx1d2FODUojQMXncqy1WOmS 7tmvBtpO40+APyMtMrPONe4133YAoOfqaxWh0acStKNt/ZzAu2 DCwcaBUXzQlFZswa+GZ9dUSupzlGC+Z+UDNTxniNvBHy/bhz4R 0nMxZKCkphzxKs8UKaClJvebD6foEbzRcZyT11hA==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .c907cc -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_c907cc: ywmLIZ9uzc7dXCfe179iw4YFXqQ4o4MlU9re5DxgEvH7Wnp97r pRpNfVyHdSJuD5xqUxNLXyiQyuwIeaCzt9cAhmEizR8v9841Zj AieSimuinFM5girXPmeWWYhIYpDgx1d2FODUojQMXncqy1WOmS 7tmvBtpO40+APyMtMrPONe4133YAoOfqaxWh0acStKNt/ZzAu2 DCwcaBUXzQlFZswa+GZ9dUSupzlGC+Z+UDNTxniNvBHy/bhz4R 0nMxZKCkphzxKs8UKaClJvebD6foEbzRcZyT11hA==}
URLs

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\9FE004-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .9fe004 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_9fe004: CFxln+ydS6YhCd2yn5+0pEjcJ4SONOgGR1NvVdN3TG30j6y5lH 6FH9GAEdPom6EKcuEHWLKW4rgdut7tB0Dn7Jvgth+pVY9T41Zj AkPgGszd4xh5Jm916J3fKJhPh/LseWTRLo6ZlvX8fRDdx0CJJO 28Y9r9jAiUa8scMITa5R9BuoamNc/yxVb2kdBAIBu8mAoFoJzB WkXU62Vdhotv380GlRYQBK//WMpSPmLor4XoqaFXdNexfMF9O+ 4+kUYRy4KNHNSECo8ZLuVqkmMlVqoFU9VySii7HQ==}
URLs

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files\VideoLAN\VLC\lua\http\9FE004-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .9fe004 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_9fe004: CFxln+ydS6YhCd2yn5+0pEjcJ4SONOgGR1NvVdN3TG30j6y5lH 6FH9GAEdPom6EKcuEHWLKW4rgdut7tB0Dn7Jvgth+pVY9T41Zj AkPgGszd4xh5Jm916J3fKJhPh/LseWTRLo6ZlvX8fRDdx0CJJO 28Y9r9jAiUa8scMITa5R9BuoamNc/yxVb2kdBAIBu8mAoFoJzB WkXU62Vdhotv380GlRYQBK//WMpSPmLor4XoqaFXdNexfMF9O+ 4+kUYRy4KNHNSECo8ZLuVqkmMlVqoFU9VySii7HQ==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .9fe004 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_9fe004: CFxln+ydS6YhCd2yn5+0pEjcJ4SONOgGR1NvVdN3TG30j6y5lH 6FH9GAEdPom6EKcuEHWLKW4rgdut7tB0Dn7Jvgth+pVY9T41Zj AkPgGszd4xh5Jm916J3fKJhPh/LseWTRLo6ZlvX8fRDdx0CJJO 28Y9r9jAiUa8scMITa5R9BuoamNc/yxVb2kdBAIBu8mAoFoJzB WkXU62Vdhotv380GlRYQBK//WMpSPmLor4XoqaFXdNexfMF9O+ 4+kUYRy4KNHNSECo8ZLuVqkmMlVqoFU9VySii7HQ==}
URLs

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files\VideoLAN\VLC\lua\playlist\9FE004-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .9fe004 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_9fe004: CFxln+ydS6YhCd2yn5+0pEjcJ4SONOgGR1NvVdN3TG30j6y5lH 6FH9GAEdPom6EKcuEHWLKW4rgdut7tB0Dn7Jvgth+pVY9T41Zj AkPgGszd4xh5Jm916J3fKJhPh/LseWTRLo6ZlvX8fRDdx0CJJO 28Y9r9jAiUa8scMITa5R9BuoamNc/yxVb2kdBAIBu8mAoFoJzB WkXU62Vdhotv380GlRYQBK//WMpSPmLor4XoqaFXdNexfMF9O+ 4+kUYRy4KNHNSECo8ZLuVqkmMlVqoFU9VySii7HQ==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .9fe004 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_9fe004: CFxln+ydS6YhCd2yn5+0pEjcJ4SONOgGR1NvVdN3TG30j6y5lH 6FH9GAEdPom6EKcuEHWLKW4rgdut7tB0Dn7Jvgth+pVY9T41Zj AkPgGszd4xh5Jm916J3fKJhPh/LseWTRLo6ZlvX8fRDdx0CJJO 28Y9r9jAiUa8scMITa5R9BuoamNc/yxVb2kdBAIBu8mAoFoJzB WkXU62Vdhotv380GlRYQBK//WMpSPmLor4XoqaFXdNexfMF9O+ 4+kUYRy4KNHNSECo8ZLuVqkmMlVqoFU9VySii7HQ==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .9fe004 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_9fe004: CFxln+ydS6YhCd2yn5+0pEjcJ4SONOgGR1NvVdN3TG30j6y5lH 6FH9GAEdPom6EKcuEHWLKW4rgdut7tB0Dn7Jvgth+pVY9T41Zj AkPgGszd4xh5Jm916J3fKJhPh/LseWTRLo6ZlvX8fRDdx0CJJO 28Y9r9jAiUa8scMITa5R9BuoamNc/yxVb2kdBAIBu8mAoFoJzB WkXU62Vdhotv380GlRYQBK//WMpSPmLor4XoqaFXdNexfMF9O+ 4+kUYRy4KNHNSECo8ZLuVqkmMlVqoFU9VySii7HQ==}
URLs

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Targets

    • Target

      qeSw.bin

    • Size

      296KB

    • MD5

      258ed03a6e4d9012f8102c635a5e3dcd

    • SHA1

      a3bc2a30318f9bd2b51cb57e2022996e7f15c69e

    • SHA256

      8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160

    • SHA512

      967414274cb8d8fdf0e4dd446332b37060d54a726ab77f4ec704a5afe12162e098183add4342d1710db1e1c3b74035a001cf4c2d7790a27bf6d8381c34a96889

    • Netwalker

      Ransomware believed to be a variant of MailTo.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Modifies service

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks