Resubmissions

25-06-2021 19:02

210625-3pn69lxvl6 10

19-01-2021 19:11

210119-d5lpreq1xs 10

17-01-2021 18:34

210117-13dmhlbfvs 10

17-12-2020 13:19

201217-th1vrg4m2n 10

General

  • Target

    Joker.exe

  • Size

    649KB

  • Sample

    210117-13dmhlbfvs

  • MD5

    182f7543c3686426512511c74548e724

  • SHA1

    3f114d85370d2014004e06bd7b10ab2ac435b482

  • SHA256

    49c578bf49fba965320ea05c3d1c8ef2bf37d3c8943988b50ac72fd6c3d109b7

  • SHA512

    3f4fc19e3687b1a4b5cb7719f21b6b51d0f7f29ed82ce51a95c1b18ecd7660391ed116df9ed132f91c10ff639875451d67baa9414721f5b52441d3d905e65e87

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\CryptoJoker Recovery Information.txt

Ransom Note
Hello! I am NocryCrypt0r My name is NocryCrypt0r. I have encrypted all your precious files including images, videos, songs, text files, word files and etc. So long story short, you are screwed... but you are lucky in a way. Why is that ?? I am ransomware that leave you an unlimited amount of time to gather the money to pay me. I am not gonna go somewhere, neither do your encrypted files. FAQ: 1. Can i get my precious files back?? Answer: Ofcourse you can. There is just a minor detail. You have to pay to get them back. 2. Ok, how i am gonna get them back? Answer: You have to pay 50€ in bitcoin. 3. There isn't any other way to get back my files ? Answer: Nahhh. Just our service. 4. Ok, what i have to do then ? Answer: Simply, you will have to pay 50€ to this bitcoin address: 1yh3eJjuXwqqXgpu8stnojm148b8d6NFQ . When time comes to send me the money, make sure to include your e-mail and your personal ID(you can see it bellow) in the extra information box (it may apper also as 'Extra Note' or 'optional message') in order to get your personal decryption key. It may take up to 6-8 hours to take your personal decryption key. 5. What the heck bitcoin is ? Answer: Bitcoin is a cryptocurrency and a digital payment system. You can see more information here: https://en.wikipedia.org/wiki/Bitcoin . I recommend to use 'Coinbase' or 'Bitcoin Wallet' as a bitcoin wallet, if you are new to the bitcoin-wallet. Ofcourse you can pay me from whatever bitcoin wallet you want, it deosn't really matter. 6. Is there any chance to unclock my files for free ? Answer: Not really. After 1-2 or max 3 years there is propably gonna be released a free decryptor. So if you want to wait... it's fine. As i said, i am not gonna go somewhere. 7. What i have to do after getting my decryption key ? Answer: Simple. Just press the decryption button bellow. Enter your decryption key you received, and wait until the decryption process is done. Your personal ID: 80120786078BFBFD00000663
Wallets

1yh3eJjuXwqqXgpu8stnojm148b8d6NFQ

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    theemailtologin@gmail.com
  • Password:
    thepasswordoftheaccount

Extracted

Path

C:\Users\Admin\Desktop\CryptoJoker Recovery Information.txt

Ransom Note
Hello! I am NocryCrypt0r My name is NocryCrypt0r. I have encrypted all your precious files including images, videos, songs, text files, word files and etc. So long story short, you are screwed... but you are lucky in a way. Why is that ?? I am ransomware that leave you an unlimited amount of time to gather the money to pay me. I am not gonna go somewhere, neither do your encrypted files. FAQ: 1. Can i get my precious files back?? Answer: Ofcourse you can. There is just a minor detail. You have to pay to get them back. 2. Ok, how i am gonna get them back? Answer: You have to pay 50€ in bitcoin. 3. There isn't any other way to get back my files ? Answer: Nahhh. Just our service. 4. Ok, what i have to do then ? Answer: Simply, you will have to pay 50€ to this bitcoin address: 1yh3eJjuXwqqXgpu8stnojm148b8d6NFQ . When time comes to send me the money, make sure to include your e-mail and your personal ID(you can see it bellow) in the extra information box (it may apper also as 'Extra Note' or 'optional message') in order to get your personal decryption key. It may take up to 6-8 hours to take your personal decryption key. 5. What the heck bitcoin is ? Answer: Bitcoin is a cryptocurrency and a digital payment system. You can see more information here: https://en.wikipedia.org/wiki/Bitcoin . I recommend to use 'Coinbase' or 'Bitcoin Wallet' as a bitcoin wallet, if you are new to the bitcoin-wallet. Ofcourse you can pay me from whatever bitcoin wallet you want, it deosn't really matter. 6. Is there any chance to unclock my files for free ? Answer: Not really. After 1-2 or max 3 years there is propably gonna be released a free decryptor. So if you want to wait... it's fine. As i said, i am not gonna go somewhere. 7. What i have to do after getting my decryption key ? Answer: Simple. Just press the decryption button bellow. Enter your decryption key you received, and wait until the decryption process is done. Your personal ID: D8FF195B078BFBFD00000663
Wallets

1yh3eJjuXwqqXgpu8stnojm148b8d6NFQ

Targets

    • Target

      Joker.exe

    • Size

      649KB

    • MD5

      182f7543c3686426512511c74548e724

    • SHA1

      3f114d85370d2014004e06bd7b10ab2ac435b482

    • SHA256

      49c578bf49fba965320ea05c3d1c8ef2bf37d3c8943988b50ac72fd6c3d109b7

    • SHA512

      3f4fc19e3687b1a4b5cb7719f21b6b51d0f7f29ed82ce51a95c1b18ecd7660391ed116df9ed132f91c10ff639875451d67baa9414721f5b52441d3d905e65e87

    Score
    10/10
    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks