General

  • Target

    7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin

  • Size

    18KB

  • Sample

    210118-vvmmfncbwn

  • MD5

    d360e4b15da3d3b89640a3ba98464214

  • SHA1

    67816c29b8f35cff28bb4f3f1428d001a8f1f280

  • SHA256

    7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e

  • SHA512

    d00295e6d7192c0a2dfa8ccbf18fb344852fae9de074fc843b6ef20967b003c7fcff2b6835fc3dd7bd69c0bfdf714c22f972a5e609f5859d051579c94967179a

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\READ_ME.hta

Ransom Note
E P S I L O N Ransomware ⠀ As you can see, all your files got encrypted. Thats why your files are no longer readable. If you want them back, please contact us at our email below. You can send us a couple of files and we will return the restored ones to prove that only we can do it. [email protected] You can ask for more details and more help by email. You can learn more about bitcoin and encryption on wikipedia. https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption ⠀ If you already submited your payement, you will receive your private key and another decryption key with the special decryption software. More informations: 1. the infection was due to vulnerabilities in your software. 2. our goal is to return your data, but if you don't contact us, we will not succeed. IMPORTANT: 1. if you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 2. only communication through our email can guarantee file recover for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 3. please, do not try to rename encrypted files.
URLs

https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption

Targets

    • Target

      7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin

    • Size

      18KB

    • MD5

      d360e4b15da3d3b89640a3ba98464214

    • SHA1

      67816c29b8f35cff28bb4f3f1428d001a8f1f280

    • SHA256

      7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e

    • SHA512

      d00295e6d7192c0a2dfa8ccbf18fb344852fae9de074fc843b6ef20967b003c7fcff2b6835fc3dd7bd69c0bfdf714c22f972a5e609f5859d051579c94967179a

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

2
T1107

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks